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This thesis examines the network management functions 
reguired for a local comouter network. Initially, general 
Management considerations are adir3ssed. These include: 
problem determination, performance? alaiysis, problem manage- 
ment, change management, configuration management, and 
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One of the mjor objectives of any local network is to 
2 


9 
Meovidae reliable communications facilities, ceflected both 
Ma the continued availability of tha network itself and in 
the lowest possible arror cate as seen by individual 
processes [Ref. 14; Dp. ~~ CV Te To this we would add ths 
Mequaerements of high capacity and minimal eni-to-end delay 
experienced by the user. We now submit what we feel is a 
responsible and complet? iefinition sf network management. 
Our definition includes: collecridn oof measurements a 
Subsequent statistics g2neration, hardware and softwar: 
meelure detection, diagnosis Mids "“COGmece” ot, network 
performance analysis, and network parameter adjustment. 

Cne school of thought advocates nanagement or iocal area 
computer networks, while another feals that management, as 


e former 


ct 
+3 * 


Memiave gerinea it, is not reguired. qe suppor: 


of the two. The benefircs to be gained from tana o 


s)) 


nagement 
Cf a local computer network are numerous. #2 are adle to 
reljuce the impact of failires andi increase network avail- 
poet ty by detecting, diagnosing, and cerrecting hardwar 

and software problems very quickly. Gomeroleand i 


echnelogies allow network operators t> anticipate problems. 


ss 


Rather than reacting, operators are idle to analyze problems 
and take appropriate action to minimize thea, or e¢ven 
Boeelude <neixc cccurence. Management of a local computer 
Meework gives us the ability tc provide for capacity plan- 
Meomg, Menage the growth of *he network, control costs, and 
eliminate redundant or unuséd capacity. We can also improve 
Bel 


(vp 


networks performance and its availability to users by 
monitoring *he nétwork somponents a1] fhrough valuation of 


th> network as a whole, 





Preeucmeche atingem > iatent (“foeldentity and discuss the 
tools required by network management for the attainment of 
these and other benefits. W2 will begin by describing 32 
SPLICE local area computer network, followed by a discussion 
of six network managenent disciplines. Chapter 2 wiil 
present various network nonitoring nathodologiss and tech- 
nologies. In Chapter 3, we 2anter into a discussion of the 
measurement tools availabl2 to the odpsarator and suggest ten 
Management reports +o bea generatei from collected dats. 
mmepeer 4 DravVides informactiog on aaalysis timing, xetwork 
performance measure utilization ani oarameter selection, ani 
mmecomponent railwre detection, diagiosis, and a stification. 
Chapter 5 identifies and saggests solutions for the problems 
associated with managing the LAN/DON intexrface. In Chapter 
6, we conclude with a discission of the mission, 


O 
and responsibilities of a LAN cseéentral nonitoring site. 


A. ASSUMPTIONS 


To productively discuss the topics of network management, 
me 2S importamt that 3 ECOied base SOG Hunger standing 
Memieerniirg thea SPLICE (Stock Point Logistics Integrated 
Communications Environment) Ho Caimanies Comauter fh 2S 
established. This section brisfly describes the Network 
Meyer Protocol proposed foc tha SPLICE LAN. This discussion 


wee le wnclude; Srrer tecsGeionr, packet acknowledgement, 
Meee ioltONn detection, a2cc23sS control, bus control, cretran- 
SMission technique, ani »acket fornat. AG@deeclonaliy, Sth: 
network topology and physical transaissicn medium will be 


Meat atied.Finally, a brisf description of thea proposed Sni 


S 
tO End Protocol wiil be discussed. A nore detailed explana- 


= 
[en O- the SPLICS concept can be Foind in [{Ref. 1]. 


1) 





15 Network Topology and Transs#ission Mediun 


Gemini eSeem UAatlisceuned, and Global Bus topolo- 
gies were discussed in ‘Ref. 2J.. Primary considerations 


made during the selection of a todpn9logy were it's fliexi- 


bility, reliability and simplicity. Understanding that the 
structure of the network must Leni itself ¢5 change and 
reconfiguration, one author [Ref. 2: p.21J reconmended that 
Mm —oaGba! bUuS tcepology bs adopted for the SPLICE Iloecal 


computer network. 

Although a number cf traasmission mediums wer: 
discussed in [Ref. 2], nd particular technology was recon- 
Me1ded for all SPLICE network configurations. LOL A taiis 
discussion of network management, it will be assumed that 
the transmission medium is coaxial cible and that a baseband 


Beconnology is being utilizad. 


2. Network Layer Protozcol 


Deecoeera ii Zea contro. Df che DUS iS The prem. sPupon 
wawc ail subsequent chacacteristiscs are based. Nodes 
access the network utilizing random access c 
Deea(GotlA /CD). oe oS 


Mmeon iS accompiitshed through the uss of a cyclic rs 


O p 


methanism with collision jiatecti 


undancy 


G 
chacksun. The acknowl¢cizgement for a packet successfully 
received is undertaken by 2ithear sanding @ spatial acknowl- 
edgement packet or by insluding the acknowledgement with 32 
data packet bound for the appropriat2 node. Upon detection 
of a coiiision, a node implenents an adaptive binarv expo- 
nential packoff retransmlissicn technique. Finally thers 
eects a Sioglie packst format for both data and control 
melOrma=7on, Micm=aNCehems =yDe being identified in the 


packet type rield (Ref. 2: p. 53]. 


11 





Ud) 

e 
It 
la. 
ict 


Q End Protocol 


(tes 


TCP was utilized as a basis from whicn to develop. 
Beno thenSport protocol. Mist merecacrson Lor the use of TCP 
can be found in [Ref. 3]. A major coasideration during tha 
design of an end to end orotocol was the assumption that 
SPLICE LAN'S would be soarzected t23 2ach other through the 
Defense Data Network. Ths fact that the end to end protocol 
currently planned for the DDN is fcP further excentuates the 
benefits to be deriveil ody havin S (CP Sasa =eansoort 
paotocol. Investigation shows that if TCP is used in ths 
Strictest sense without any modification as the Local ctrans- 
Bert control prectocol, Simple intarnetwork communication 
Willi be achieved at the axpense 9f suboptimal intranetwork 


BectOrmance (Ref. 23 ps 73]. 


Be LAN ARCHITECTURE 


Tee section depicts and briefly describes the logical 
pea OhySicaleviews ) of the SPLICE LAN. These diagrams ars 
em@isaucded in Order to provide 2 visu3i representation which 


u W 
Meayeoe >eferred to during the distussion of natwork manage- 


ment throughout the thesis. 
feepeecocal Network Logisal View 


Tnges xe Hokes aloagj che =op Sf£ Elgure 1.1 ere aden- 
# 


Meesed as operation igs sLons implemented in softwars 
modules. The three box2s to the right and ia the middis 
represert suppor*+ functioas implemsated in software nodules. 
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Control messages flow along the logical control bus while 
data messages flow along the togicsal data bus. A more 
detailed explanation of thes= funstional modules can b3 
found in {Ref. 4}. 


2. Local Network Physical View 


tu2 
H-- 


There exists only one physical bus upon which will 
flow both controi and data messages. ThemtunctiOnS eee ane 
fied in the logical view of the network have been assigned 
to specific minicomputers. As can b2 seen in fElgure 1.2 , 


the network management function hasS not been identified. 


tJ 
ae 
(v 


eeeecteal ly, thas fumezrion Gould reside in one of all of 
the network nodes. An ini2pth discussion of this topic will 
be undertaken in Chapter 2. 


C. NETWORK MANAGEMENT DISCIPLINES 


If viewed asa sSingl2 modules, the network management 


function appears guite complex. Different aspects of the 
mUNGCtLON appear *9 overlap, whi otners appear +o = 
MesdOine and unrelated. iim Oba = O00 NOEs ~Sreecrively 


-_ 


analyze the various aspects of the network management func- 


aot, a disagoreagation of th function into unique, 
identifiable modules is indertaken. Freeman proposes six 
distinct management disciplines associated with managing the 


mBompOnen=S Of a2 computer network .Rsf. 5: pe. 91]. these 
disciplines include; prodlem datermination, performancs 
anaiysis, problem managem2nt, shanjg2 management, configura- 
tion management, and operations managenent. The purpose for 
Presen ing =heSe disciplines is ‘twofold; First, to creates 
more mMmanagable and understable moidiles through which the 
concept of network management can be discussed, and second, 
GemprovicS a foundation upon which various network manage- 


ment technigues can be ansiyzeli throughout the thesis. Each 
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of these disciplines will b Drlstiy described in th 


following sections. 


1. Problem Determination 


Problem determination is th2 process of identifying 
a failing or down componant of the istwork so that correc- 
tive action may be taken. ime lncLudies; awareness that 3 
problem exists, Zsolation of the oroblem to 2 particular 
element, identification of what caused the orobiem, and 
determination of the corres DEgagiZsclOn, “Lhdadsviaual, Or 
vendor who is responsible for the correction of that specfic 


type of problen. 


2. Performance Analysis 
Peformance Analysis deals with Glan i fae by 


answering the question of, ‘How well is the network doing 
Mat it 25 supposed to io?'. It prdvides for the measure- 
ment of certain dependent variables throughout the network. 
These measurements are thin compar3i to criteria that have 
bez=n previously establishad by some crther means (é.q0d. by 
Mathematical models). By observing ‘the variance be*ween 
these figures, a snapshot of the network's perrtormance can 
Be ODtained for that particular instant in tine. A number 
of variables measured can be classified as "tuning" statis- 
eis Se Certain parameters exist which can be adjusted by 
network operations personn2l in ord2r to effect the values 


Breetnese tuning stetistics. In this way, we can affect both 


tty 


network performance and the quality of the service provided 


by the network as perceiv2i bv the user. 


-& 


3- Problem Managemen 


icf 


Problem Management concerns ths reporting, tracking, 
ani resclution of oroblams that a a user's or process! 
n 


Peo c 
Capability +o communicats with any other user or process. 





Establishment and maintenance of 3-poroblem database can be 
accomplished in a number 5£ ways. Problems nay be docu- 
mented manually utilizing pencil ani paper. They may be 
recorded semi-automatically through manual antry into a 
database. Or, problems may be racorded automatically 
through the interaction of the problem management module 
wet the problem determination ani performance analysis 
moiules. The method chosen through which network problems 
fisieebe recorded Should provide for jiata consistency, real 
Lime inrormation or neacly so, usar accessibility, and 
inimai operations personnel envolvement. A) lek 1 oe 
possible entries for inslusion in 2 problem record is 


provided in Appendix A. 
4. Change Management 


Changes made tO 2 network component that are trot 
promulgated throughout, or made available to the network may 
lead tc substantial dseiay when communicating with that 
element or ven make that element inaccessible. Change 
management precludes ta2se ev2acs BEoiey —Oee Ua mic by 
mememerong, <«sackang, obtaining approval for, and verifyiag 
tha impiementation of changes in nactwork components [Ref. 5: 
pe 91}. Pencil and pap2ar, or manual entry ints a database 
ac2 two metnods by which chanjy2 management may »b3 


accompi:shed. 


5. Configuration Manayemens 


Configuration manajyement provides for the creario 
of a database which contaias the past, present , and futures 
physical and logical charasteristics 2f ail network elements 
ees 09: Poe 91]. Tneludei in this would be the SPLICE mini- 
conouters, host computers, shared ressources, the subnetwork, 
Memeeper=inéent initocrmation soncerning any connected networks. 


Th2 configuration managem2an* databas2= should b2 accessible 
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by both software modules and users as needed. Updating and 
Maintenance of this database could pe accomplished in thea 
sane manner as the problen managemant database. bers Shas 
researcher's opinion that configuration management couli 
most efficiently be accomplished utilizing autonated techni- 
qu2s which are based on the interaction of the various 
network management modules. 4 lis of entries that may b2 
included in a configuratidn managemn2at record of a network 


con ponent is included in Appendix 8B. 
6. Operations Marayenent 


Operations managemant supports the remote manipula- 
tion of various network elaments [Ref. 53: pe. 91]. Some o£ 
the forms *his manipulatioa takes includes; tasting a piecs 
of hardware such as an ajapter, testing specific software 
Such as @ process which counts ths iumber of tines an indi- 
Viiual packet attempts tds access the channel 
successful, adjusting parameters in order ¢ 
values of certain depeniert variables which characterize <= 
pecformance of the network, ari starting up a renot 
Bein a rnOod2 which acts 25 an artificial traffic gener 
Meet tOnally, during th process of astwork reconfigurati 
this management function supports the remots Loading 


software into the appropriate network element. 
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II. DESIGN ISSUES IN NETWORK MONITORING 

Measurements allow us to gain valuable insight regarding 
network usage and behavior (Ref. 6: pop. 1439}. They provide 
a means to evaluate the perfornance of th2 implemented 
protocols. Additionally, they give the designer ths ability 
to detect network ineffici2ancitzs ani identify design flaws. 
On an operational ievel, n2asurement provides th2 statistics 
upon which the network is tuned through adjustment of appro- 
priate perameters. In 2 ylobal 32152, measurement can ba 
se2n as the foundation ipon which network management is 


based. Hamming expresses the importance of n2asurement i 


i3 


Mae statement, "It is difficult to have a scisnce withour 
measurement" This emphasis on an accurate measurement capa- 
bility assists in unierstanding why such eiaborates and 
complex measurement techniques have deen devised for experi- 
mental and operational networks. 

Before any type of measurement is conducted 9f a network 


or it's associated componzats, two basic questions must be 


answered. They are, ‘What is 45 b2 measuredi?', and 'wWhy 
should the measurement be taken?*. These qu2stions will be 
adizessecd in Charters 3 ani 4 resosctively. Po this tems, 


an Explanation cf basic nonitoring methodologies wiil be 
Matetrtaken, fOllowed by 2 discussidn of current monitoring 


technologies. 


Aw. NETWORK MONITORING METHODOLOGIES 


Gurcen=ly, there exists thr23 basic néethodologias 
Meer zed as the fomdations for the creatioa of various 
network monitoring technologiss. Th2se three methods area 

Q 


hardware monitoring, saftwacre Icons ng, and hybrid 
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monitoring. These methods will be discussed for the purposs 
of establishing a basis upon Which the Hone Ob in3 


technoiogies may be analyzed. 
1. Hardware Methodology 


A pure hardware moaitor is a unit ctha* is both phys- 
Mealiy and logically distinct from the network component 
being measured [ Ref. 7: p. 57}. 
Tha interface between the monitor and the conponent 1s a 
Baysicear probe used for to= collection and passing of elec- 
meenitc Siognals Erom the component ¢>5 the monitoring device. 
Figure 2.1 depicts a generalized hardware monitoring device 
feet. 7: pe. 57]. 
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Figure 2.1 Hardware Monitoring Device: Logical View. 
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The critical item needed foc 2 hardwar2 moniter is 
an electronic signal that indicates the occurence of an 
event [Ref. 7: pe 57]. Sinc2 many signals to be monitored 
are of a relatively low voltag3, %on2 must consider that tha 
introduction of a monitoring device nay disturb tne normal 
Bpstatzon of the circuit being monitorsd. To preclude this, 
a high impedance probe can be utiilz2d. The signal observed 
by the probe is amplified and pass2i to a signal fiiter andi 
Sopbination logic unit. The task of the signal filter and 
Bem oehec On logic uni iMSsefo Mask "ered Pesmb2ne Siaqnrais 


received from various probes. This xutput is then sent to 3 
1 


Bie and count unites Here, Vio tudes On. ©Of 2° ° Sspecir2s 
signal, or the nmumber of times a cartain signal occures can 
be recorded. Having collacted the required data aporopriats 


for the test being conduct3d, the csontents of the time and 
count urit can be directsi to a mass storage dsvics fer off 


Memesaneiysis 95, directly to 1 usec for on-lins analysis. 


The main advantage of a hardwar2 monitor is it's 
ability “*o sensé 32 wid? range of BmOwep= 200 —SOLawar= 
events. in addition to sost, th main disadvantage of a 
Memewar= NONLtSObIng déevic= is it's limited ability =o detect 
the GLius@eer che Set SEmisagnals tt wsemonitoring. 


MieIOUG to VartOUs dGfinzei21S exist, 4 sottware 
monitor can be viewed as a oprocess which resides in the 
conponent being monitored. Two types of software monitors 
Seist which are appropriate for th2 task of monitoring a 
computer network. They are the int2rrupt-intercept method- 
Ology and the sampling nethodology “R82f. 7: p. 56). 

The interrupt-intercept methodology embraces the 
ide@ of carrying out sone typ2 of nonitoring activity every 

ane the state of the particular resorce in which thse 


n 
Meme.Or is resident charges. fon TOM <OSlLag COUTIne is 
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invoked whenever an interrupt is jenerated. The scheme 
calls for intercepting 2ach Znaterrupt as it occures, 
MeIEecceting 1c co a WONALOLLAgG cCotitine Where the interrupt is 
analyzed and appropriate nonitoring functions activated, and 

inally, passing the interrupt to it's intended destination. 
This monitoring methodsloyy has ths distinct advantage of 
allowing measurements to b2 taken as an integral part of the 
system rather than as a lower level application program. 
Substantial amounts of — tines and memory utlization 

whi 


OL 


(D 
fle 


yeuse alieyel B te de foes in 2 .So 


rs 


s 
arma requ 


ct 


requires that the softwar2 moniteriny program cun at a ver 


Mey Priority to prevent other intecrupts fron deactivating 


mmo Monitor (Ref. 7: pe. = ° 

The sampling eathodology traats the software moni- 
=2Oring progran as a nornal 1s22 program FOr a 
multiprogramming system. The activ3 Neer tie On tops ng 


program may be accomplish21 by the 29 
9 


acing system, by another a>nitoring application progra 

by néetwerk operations personnel. This activation may occure2 
Ge cearcon intervals, scheiuled intervzls, or 2 combination 
ie rcot. Wiremoeteectn on S= 2nter=sanole perizcois is critical 
M@menadt it MUSt nOt be synchroniz2i with the soccurence of 
Peeemes Which are being measured by the monitor (;Ref. 7: op. 


Pye AS With the interruot-intercept methodology, 2 signif- 
icant amount of processoc time ani memcry space may be 
Beqguired. 

The principal advantage of the software monitors 
presented above is their ability tos associate sccurances of 
measured events with their causes. [h2 primary disadvantags 
2s their requirement for substantial cesource utilization. 
The strengths of the hardware and software monitoring meth- 
oddlogies have been combined and their weaknesses elianinated 


through <he use of a hybrii approach. 
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3. Hyprid Nethodolog 
h 


In contrast to th2 hardware monitoring nethcdology, 
the hybrid approach to monitoring dis2s not view the hardware 
mcnitoring device as being invisibl= to the natwork compo- 
nent. The hybrid methodslogy utilizes a microcomputer to 
control the functions of the hardwar2 monitoring d¢vice in 
response to data gathered by hardware probes. Bunce 2. 2 
represents the legical viaw cf a hyorid monitoring device. 
Tha data channel provid2s a means by which the software 
Mon-st£or resident in the davice b2inzj acnitored can communi- 
Sece With cne hardware nonitoring device. Aloe this 
channel can pass interrupts and n3ssages conserning the 
occurence of software sveits within the component. These can 
then be associated with signals sens2i by the probes of the 
hareware monitoring devic2. This dveccomes the strict hard- 
ware monitoring methcdolosgy's inanpility +9 associates a 


Begmal With a specific evant cecarance within the network 
component. Additionally, <tn2 problem 


of component resorce 
Memiizet On associated with the strict 
methodoicgy is overcome %2dy the 
Gesing £unctions from the netw 
monitoring device. 

Uecmmeteaqyes Lob tive 1OGatid3 of mOnltocing capabil- 


Beles Within a computer network implicitly utilizs one of 


Po met hcdologies, Or a variation thareof, discussed above. 
A number of these techndlogias will be discussed in the 


following section. 


Be. NETWORK MONITORING TECHNOLIGIES 


There are Cerra seCnsidersati ons eheaee Ssnould b> 
adiressed when selestiag a Mon sc oOc no Boerne |OGy. 
Initially, 32 decision has be be 22324¢ on whether of rot 3 


record of every cccurance 29£ a4 certain event should be made, 
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Figure 2.2 Hybrid Monitoring Devices: Logical View. 


sometimes called trace monitoring “R2f. 7: Demet Dou. =e OL Oo 
collect samples from the network at selected intervals of 
tine. Timing considerations for the NBSNEIT measurement 
System indicate completa neasurament is possible [Ref. 8: p. 
725 j- He's “architectuze, being similar to that of the 
SPLICE LAN would seem t>9 indicate t1at complet2 measurement 
would be possible for the SPLICE LAN. Whether this would be 
desirable or practical ire questions that r2anain to be 
adiressed. The technigu2 selacted nust be able to monitor 
both hardware and softwar2 components individually and any 
Sondinatijon thereof. [T1212 tiLeéevel ST NOR Teoeing co. b= 
conducted must be determined. Descsuene, tLechnolocy under 


Memo. derae=ic0n provide ch2 capability of both 2 macroscovic 





ani microscopic level of monitoring? Is the monitoring 
technique capable of supporting 3 real-tine analysis 
requirement? To what degree does the monitoring technique 
Sntroduce artifact int the systen? Other items to be 
considered Include; 2 LOGK resolution and etock 


synchronization. 


1. Sidestream Monitoring 


The sidestream monitoring technology °-Ref. 5: De 
92], requires that probes be attachedi to the sias of network 
components. By attachiiyzy these probes to the ‘side’ of 
network components, w2 mean ohysisally placing them such 


that they may Sample and analyze data from physicai inter- 
faces within the component, and at ta2 interface between thea 
conmpcnent and network bus. These probes extract and analyzé 
data irom physical intarfactes established with these 
elsments. Additionally, the sidestréeam technique obtains 
information about the network interface and the subnetwork 
through the use of a maaurenent nodule resident in the 
adaptor. Information gathered by th2se probes and modules 
Mey De Senz =O a network ndOnitoring center, of to a set of 
managemen* programs via a Secohiary Channel which ois 
frequency-division multiplaxed ont> the same circuit being 
used by the primary data channel. 

A major advantage of the sidestream technique is 
Mees ability to alert network operations personnel of 
SeGeain types -of problems without Laterferring with normal 
fee a trartfic. Certain t2sts nay also be undertaken whict 
utilize this secondary channel. in <has «way, isolation 


testing may take place without disrupting the primary data 


channel. oven though 32 secondacy channel assists in 
Ssotiating and correcting certai probiens, Chewe- Ste 1). 
renain certain tests chat must utilize the primary data 
channei for their accompiishment. This has bean found to be 





on2 of the major problens of the sidestream technique due to 
the fact that, during the sonduct of these tests, the 
network is unavailable. 

The sidestream monitoring t3cshnology presented hers 
is a subset of a more encdmpassing network management 
philesophy. Our discussion has briefly touched on the topic 
Of component failure identification. This was determined to 
be necessary in order to nore clearly diafine ani explain the 
advantages and disadvantages of this technology. This 
subject will pe addressed z:gain whan a discussidn of various 
Bechnigques for identifying, moos. ng , ania “C@rrecting 


failing network components is undertaken in Chapter 4 
2. Mazastream Monitoring 


The mainstream mo21i*ocing technique operates thru 
thea use of hardware and software imolamented among existing 
n 


2 
network components. Rese  2dg2e25 provids data to 


‘ey 


Ss 
network monitoring center or a set of network managemen 
programs. Nee 2h teats one ot PErORLSnS E€xXiSting within tha 


ia 
Met work =S accomplished through the generation of asynchro- 
J 


nous prcblem messages. These messigeS are communicated as 
Mertat cata trafiic on the primary data chznnel. Data 
provided by these asynchronous probl2m messages is usually 


Sufficient t9 isolate 2 problam ¢9 3 particular component 


ctr 


Meeneut further problem isolation ests such as thoesa 


required by the sidestr=eanm method. PecOr ©~Selrds wethin 3 
Mevelrem message Contain sa2cific tinfdstmation concerning the 
problem being reported. PreOoriacmon COmrtas hed in £he error 
records is generated by testing modules resident in «the 


network components, which are invok2i upon problem recogni- 
£ information contained within «he problem record is 


an 


Spechiiec.§ DEOblen, 


yy 


if 
Pers Cc2cnt ¢5 isolate the cause oF 
ona 


aid iti MP celaceon teS-iag iS initiated. 





The major advantage of th2 mainstrean monitoring 
technique is it's ability to isolate and diagnose a problen 
based upon information sontained in th2 problem message. A 
problem with this technique evolves around ths requirement 
for these problem messages to utilize the primary data 
channel for transmission ¢t) th2 central monitoring site. If 
an adaptor is down through which th2 message nust pass, or 
if the subnetwork congest2i1, the problem messag2 may experi- 
ence some delay before b2ing comnuricated to the central 
monitor=ng site. 

Like the sidestreaa technigus, the mainstream *ech- 
nology presented here is a subset of a more encompassing 
network management philosophy. Distussion of problem iden- 
f[eicat.on ant isolatio21 was incladed for clarification 
purposes. Additional discussion on th2 subject of component 
femiure identification, isolation, and corréestion will be 


undertaken in Chapter 4. 


MOE Cl=mneewookK bends i2*+self naturally to 2 
ea te alized measurement approach ner. oe Si UZ2I46 
Ceitralized monitoring requires modification of the adaptor 
connecting «he processor which houses the network management 
mimccitOn to che bus. Through this modification, the adaptor 
@em monitor all packets on the network. Some 9f the infor- 
mation which can be extrazted and datarmined from monitoring 
packets transiting the natwork incluies; packet size, number 
of packets of each type transmitt2i, and intercarrival tine 
Since last packet. Since the nodifi2d adaptor simply makes 
m@eeopy Cz the passing pack2t, 2xtractts the required inforna- 
eon £rOMm iz, and discards the copy, no artifact is being 


sptrocuced into the systen. 





Certain important information cannot be obtained 
utilizing the centralizei monitoring technique. The time 
between arrival of a packet at tha network interface and 
it's subsequent transmission onto th2 network is only avail- 
able at the interface. Thus we hav2 no measurement of the 
effectiveness of our access protocol. Meehougiea collision 
Bueeche retwork Can be detected by th? central monitor, it is 
not capable of determining which nod2s packets ware involved 
em the collision. 
he central monitor is biased. This is caused by the propa- 
gation delay between the sanding adaptor and the monitoring 
adaptor. Bgue 2s aenptecs 2 15531 network with centtal- 
az2d monitoring. 
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Figure 2.3 Sentriiized Pousztoring. 





Figure 2.4 represents a decentralized monitoring 
scheme. In uSing this approach, the burden of network moni- 
toring is placed on 2ach individual intercface. The 
functions of the central nonitoring site no longer include 
monitoring. The tasks parformed by the central monitoring 


ete are now restricteli to Gata combbection from. the 
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Figure 2.4 D2centralized Monitoring. 


Gaemet Ors, data reductioi and data analysis. Measurement 
BnlOrmation is obtained by the cantral monitoring sita 
through the receipt of information oackets generated by <=ne 
individual adaptors. [Transmission of measurement inforna- 


tion may be as frequent as with avery packet. Other 
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Beotocels "all for the transmission of 


measured information 


after a certain amount of time has slapsed, or, after a 
certain number of events have occurei. ; 
With a decentraliz2d approach all information about 
the network traffic is availabis {[{Ref. 8: Pp; 725 1. 
Mefermat.0On about collision indussi delays and collision 


counts cén be obtained fron each adapto 


packet transmission and receipt are a 


Positive attribute of decentraliz22 
epi lity to identify «hese 2odes 
ap a coOliision. RO.DCOVMdesshis satan 
tional memory and real time clocks nist 
interface. 


to the 


each network Additionaily, 
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Mie tzans@assuon 2f data to the central monitoring sit? is 
initiated upon the termination of 32 logical connection. 
Implementation of this protocol redices the introduction of 


artifact into the systen. 
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Figure 2.5 HY bEid’ Soa itoring. 


In combining th2 advantages and elininating tha 
disadvantages of centralized and d2centraliz232 monitoring, 
mm a1ybrid monitoring technology has providsd ‘the network 
with an accurate and conprehsnsive measuremeit and moni- 
Bering capability. On2 disadvaatage deais with the 
complexity of coordinating the analysis of decentralized and 
ceatralized measurement (Raf. 8: p. 725}. 
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C. CHAPTER SUMMARY 


This Chapter began with an explanation 9f hardware, 
software, and hybrid monitoring methodologies. Strengths 
and weaknesses of each ware discusse2d. Thos= attributes, 
both positive and negativ:3, associated with software and 
hardware monitoring were found to be the criteria upon which 
the development of the hybrid approach was based. 

“In the second section of this Shapter, imolementations 
of the basic methodologies were presented. Lewes TOT Lag 
technologies addressed a@ere; Sliestrean, mains<ream, 
centralized, d¢centralizsi, and hybrid . monmtoring. The 
@escussi:on of each technology inclui2i; a brisf explanation 
of the operation of the nonitoring technique, presentation 
of advantages and disadvantaaqes, ani in some cas2S, compar- 
Beon tO Ochie@r monitoring tachnologiss. 

Each one of the monitoring teshnologies presented is 
capable of providing acaguate monitoring and measurement 
capabilities for use by th2 SPLICE LAN manageneant function. 
It is proposed that the hybrid teasthaique be adopted as the 


a 


Meme roring technology utilized by the SPLICE LAN. This 
technique emphasizes the toncept of minimizing 12a%2 collec- 
eaonat Meewonrk aNteriase s. InLy those measurements 
undbtainable by the central monitor would be gathered by th2 
adaptors. AS in the mainstream moaitoring tachnology, each 
adaptor would be capable of problen detection and invoking 
Mesal test modules which would gataar data concerning tha 
problem for subsequent transmissio1 to the cantral moni- 
Boring site. Data collested oy th3 adaptors would be sent 
mem the central monitoriagjy site as administrative packets 
yen tne primary date chaniel. In aidition to the «ransmis- 
Sion of routine measurement information upon ths termination 
Of each logical connectidr1, problen n2ssages, Similar <9 
that implemented by the mainstraan technology, will be 


Eeansmictted asynchronously to the central monitoring site. 
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AND 


fo this point, the general arcaltecture of a SPLICE LAN, 


along with a proposed monitoring methodology has been 


presented. Now that a nethod exists which allows us ¢o9 
Sptain information from the network, themerocusmof this 
thesis changes to addr2ss the question; What measurements 


ani statistics should w2 bd2 able t5 derive from the network 
in support of experimental and opsrational functioning? An 
attempt will not be made t> itemize neasurements and statis- 
tics required for the accomplishnent of eacsn specific 
experimental or operational enievor. Rather, a discussion 
of basic measurement tools will b2 andertaken, ‘followed by 
the identification and 2xo9lanation of measures and statis- 
tics appropriate for use in managing local arc32a networks 
which must interface with the DDN ard wheres control of thse 
dominent DDN does not com2 under the authority of the LAN 


Managers. 


A. NETWORK MEASUREMENT TOOLS 


In order td) evaiuate the oerfornance of a network, and 
to identify down or failiny ccmponents, several measurement 
tools must be available. Thes2 tools are: cumulative 
meveoisteics, trace statistics, snapshot statistics, artifi- 
Mea! trarfic generators, amulation, 2 MNStwork measuremenc 
Se@eect Which includes control, coclilaction ani analysis of 
data, and a netwerk control center which accomplishes status 
MemOrt=ng, monitoring, and controling the network. These 
Miecer tWO 2901S may be conbined ints a single entity which 
Moemsometimes called a modiitoring canter. Bach of these 


megs Will be addressed in the following section. 
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1. Cumulative Statistics 


Cumulative Statistics consist of data regarding a 
variety of events, accumulated ov2r 3a given period of time. 
These are provided in th> form of suns, ‘frequencies, and 
histograms [Ref. 6: pe 1439}. This tool is ona that should 
be included in the capabilities sf the SPLICE tlocal area 
computer network measurem3it facility. Since some cumula- 
tive statistics can becoma quite lonjy, it is wis2 to control 
thsir transmission to tha central site in som> wy. On2 
approach might be to desigaate certiin items within a cumu- 
lative statistical messag2 as being »ptional. fhis provides 
network operations personnal with maay measurement capabili- 
ti2s, yet preclujes th3 formulatioa and transmission of 


excessively long cumulativ2 statistical messages. 


Pat ace STatis-2cs 
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Trace statistics 2llow network operations personnel 
meme teeraily roOllow a pasket through the network and tod 
learn of the route that it takes and tne delays it encoun- 
ters [Ref. 10: Da 033 |. Obviously, ina bus oriented 
network, there does not 2xist a requirement to identify the 
route a packet has taken > it's destination. Although more 
apolicabieé to a2 packet switch3d stor2 and forward network, 
certain aspects of a traca mechanisn may prove useful in 3 
local area network. Suzs2 an are2 might include possibly 
tinestamping the packet as it arriv2i at the aiaptor from a 
processor, and subseguaatly recording the tim2 the packet 
Was Successtully transmitted. Aaaecaondaiiy, the packs: 
could be timestamped wh32 it arrcived atthe destination 
adaptor and subequently recsord the time at whish che packet 
is forwarded to the residant processor. These statistics 
can then be forwarded t> a central monitoring site upon 


demand or at some predeternineid tinea. 
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3. Snapshot Statistic 


WwW 


Snapshot Statistics provid2 an instantansous look at 
a device showing it's state with cegard to various queu2 
lengths and buffer allocation [Ref. 5: p. 1440]. In a high 
speed, dynamic environment such as a local area network, 
these types of statistics san prove valuable in the evalua- 
tion of certain protccols. EvaluatlLon oc a network access 
protocol could be conduct2d by observing the length of the 
‘packets ready fer transmission gquiuz'. Additional informa- 
jon that could be contaized in a siaapshot of 4 particular 
network component or set of components are processor queues 
lengths, storage allocation, and status of adaptor buffers 
fOr receipt and transmission of pazrzksats. 


Tat MeeeGivdle Trartis= Generators 
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Micmuso OT merit ilcial traffic generatore provides 
network operators with tae ability to creat2 streams of 
packets with specified jiurations, inter-packet gaps, packet 
[Meagqths and other appropriate charasteristics [Ref. 6: p. 
1440]. This tool plays a major roles during the implementa- 
fom of the LAN. fines absene> SF Isutfiement traffic 3 
Meee certain aspects of the network, art@fiicial ‘+raffic 
generators provide the mechanism through which varying 
Met WOK io0ad conditions can be smaulated. This provides 3 
more realistic environnant in Which testing may be 
conducted, and provides a mechanism that can be used <9 
identify network problem areas. By doing «his, we are able 
Meme ritecct modifications to the LAN while it is in it'ts 
infancy rather than attempting to m2k2= changés when pro 
tion activities are heavy and corrections more expens 
meeeesOraeliiv, artificial traffic gei2rators nay be used td 
Seanad anelyze various r2atwork protocols. PhS ess “2'C 


plished through the genaration of identical transmission 





strings, thereby providing a basis upon which the perforn- 
ance of the varicus protos sis can be compared. 

Amer {[Ref. 8: p. 726], has ijentified five capabili- 
ties that should be possessed by an artificial traffic 
generator. These incluie the ability to: 1) generate 


packets with a constant, uniform, oc Poisson size distribu- 


eS 1h, 2) generate packats with constant, unifornga, or 
exponential interarrival times, 3) direct paskets to any 
specified destination, 4) communicat2> with the monitoring 


System to synchronize traffic generation and data coilection 


and 5) permit on-line operations p2rsonnel control. 


Emulation is the creation 2f an illusion that there 
exists more components 2f 2 certaia kind in the network then 
actually exists. Each one of thes2 “rake” csomponernts is 
Saoapte Of displaying the characteristics of, and performing 
Mammnmecr2 Ons Of 2 "real" “physical somponent of that type. 
Emulation is required wnan there are not endugh network 
Gemponents to provide sufficient traffic generation anda 
range of nodal characteristics. In supplimenting ‘tnese 
areas, emulation gives th2 operator 2 better understanding 
Berpmecwork behavior under varisus ssafigusations . Closely 
Mmemated tO this is the us= of emulation in conjunction with 
capacity planning. Throuja emulation, we are abie to deter- 
Mine what effect a chanjg@ to the network configuration will 
have on various pertormant2> measures. Decteuse ton 2 whach 
emulation might be employsi would be to determine the affecx 
meen g Ot deleting a2 hos= processor from the SPLICE local 


arsa computer network. 
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In the early, expacimenatai days of the ARPA Computer 
Network, there existed physically separate measurement and 
control centers. This allowed for continual experimentation 
with the network from the measureneit center, while actual 
control of the network #as conducted from the control 
center. These two functions of measuring and controlling 


have been combined, and will be uniertaken by a single moni- 


M@erang center for the Defensa Data Network (Ref. 11: De 
95-102}. ine responsibilities of 2 Network 
Measurement/Controi Center include: conerolitng the meas- 
urement facilwenzes; Souectmang — 29d analyzing data, 


generating status reports, and monitoring and controiling 
the network. These responsibilities, as they apply toa 
local computer network, #@ill be addressed in much greater 


@erailt in Chapter 5. 


Be. MEASUREMENTS AND STATISTICS 


Now that the measuremeit to0ls aave been Lisntified and 
dz:scussecd, the question arises, ‘How do we select and imple- 
ment the appropriate tools for t)22 measurenent task at 
mand?', Before this subject can be addressed, thea answers 
to two questions posed in Chapter 2 must be determined. 
Those questions were: Why should th2 measurement be taken? 
fe. Ce What managerial and r2search questions are to be 
answered by the measurement ?), and, what is to be measured? 

2.4. What specific network characteristics must be measurei 
in order to satisfy *hese questions?). 

An approach t0 anSw2ring thes= two questins is as 
follows. Metaclevem 6 tS GpPropeEitate “=hat the object of 
the measurement operation be defined. This entails the 
BGsntification of some spacific area of the natwork to be 


investigated. Miecermjunce cn with Eis, Sis goals of ‘the 
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measurement operation are solidified. The next step is to 
select those performanc2 n2asures that best characterize ths 
area of the network being studied. Parcs lve cone Specific 
measurement tools most appropriately suited for the measutre- 
ment operation are identified and selected Or 
imolementation. 

Goais of measurement »perations ire usually notivated by 


sire for software verification, for performance evalua- 


UW 54 
0 


Peranceve-fication, to ds.btain feedback for system design 

Cus, co podeiwet=y ISkW Dm £atiing components, and to 
Study user behavior and characteristics. perfodcmance meas- 
ures can be catagorized as basic, special, Or composite 
Exampies cf baSic measurements inclui2 throughput and delay. 
When examination of a4 specific orocedure is required, 
specialized measures must be used ¢9 compliment the basic 
measures. DiceveasoramedeataMoadsirang aespecific at =r2bute 
Sea Speciric network conponsnt. Pama lay, in ord¢r <9 
analyze some glotal systez properties which canaost be easily 
described by throughput ani delay, i£ becomes necessary to 


agjreqate a set ck measuzsnents that have been taken over 


jv 


Specific monitoring perioi. This aggregation of neasures 
called composite measur2m2ac. Examples of conposits mea 


S 
Beceigciude, fairness, congestion protection, Sable y, 


fos 


robustness of network algorithns t> Line errors, nd reii- 
miucyeGL a Netework configuration with respect to component 
tlures (Ref. 6: p. 1443]. 

Returning to the subject of naasurement tool selection 
and implementation, w2 find that 32 subset of these to01s 
have beer utilized in obtaining specfic data from an op¢ra- 
tional icocal area computer network [Ref. 8]. In describing 
Gértain reports generated from data collectsd throughout 
this network, the researcher will b2 attempting to show how 
Bie tools are selected aad iategrat PAOEde: LO provids 


network operations personnel wit Sectaa =<, eamMely vend 
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sutficien+ information upon which the management of the 
network may be based. 

It would be infeasibl2 to identify and provide rationale 
for every measurement that could be taken from a local area 
network. Additionally, this list would be 2 dynamic one, 
dependent upon the goals and objectives of the specific 
network analysis operation <t>9 b@2 andertaken. For these 
reasons, an established naasurement cavnability for 2a local 
area computer network will be invastigated in an attempt +9 
bring forth and discuss t13 implenentation of various mneas- 
urement *ools as they op2rtain to ‘tne SPLICE LAN. Ten 
performance reports have been implemented for measuring 
MoaNST <raffic (Ref. 8]. Paci wr=oo5t . is classified’ as 
either traffic charaterization or parformance analysis type. 
meraltti characterization reports indicate ths workload 
placed on the system. Parfornance characterization reports 
migecace the time delays, utilizatiois, etc., which result 
Meome a Given load and network Sonrizgir3ation. [They describe 
the dependent variables that are observed rather than cont- 
molled, and are used f9r ‘tuning the network and making 
pecformarce comparisons [R2f. 3: p. 726]. At this time, 3a 
brief description of eath ceport will be given, along with 
appropriate comments relating to requirements of, and recon- 
mentations for the SPLITE LAN. 


aedOs: COMMUN: Cation Mat 
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The dost Communication Mtatri MmMGweasss. the, <lafieis 
Flow bectween connected noies. For sath node, data tabulated 
anciudes: the total number of packets, data packets and dat 
bytes received from and saat to all other nodes. From this, 
mmemcopCrtion of data paskets t9 total packets, and data 
bytes to total bytes are ietermined. Ue 2285 che Moni; 
toring technique proposed for the 


S 
ime shoCrmation could be abtained by the central monitoring 
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PMrecreenrougn t's tap :ato the cshannel. In this way «he 
number of bytes in a packet Can be counted by the monitoring 
center, and the source, d2stination, and packet type deter- 
mined from the header. Ailitionally, 2 summary of the total 
network traffic is made available which includes total 
packets, data packets, ani data byt3s transmitted, and the 


mean number of data bytes per packet. 


MriemGr OO cCOmminteoa: 207 M2tCix indicates the traffic 


}-!- 


flow between any user defined groupings of nodes. The same 
Hype Or information tabulated by the Host Sommunication 
Matrix is recorded by th® group comnunication natrix. The 
possible extensicn of this contept t5 include tha recording 
of the traffic flow between vacisus usec designated 
processes may prove more valuadie than the information orig- 
Moet y seen as the product of this report. An example of 
mmeeeWouwd be che recognition that 2 number of processes 

Ieez]= che Same date ril> on a regular and possibly concur- 
reat basis. ASSumenG this data 25 Saderertly kept on a taps 
Seotage device (which is not out of the gqaastion in a 
government installation), and possessing the information 
provided by the Group/Proc2ss Tommunisation Matcix, serious 
Semsideretion should be given to ralosating this data to 3 


faster and more accessible storage device. 
3. Eacket Tvpe Histoyran 


The Packet Type distogram rerords and summarizes the 
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Boel DUctlOn of each tyo2 of packet transmitted on tha 
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packet type histogram scan be easily accomplished by 4a 


ceéltral monitoring site. A summary of packet types couild 
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feria zacion, information throughput and information utiliza- 
tion can be determined for th2 network . In this way, 3 
true picture of the beneficial usages of the network can be 
obtained. Collecting th2 measSuranents required for th? 
creation of this report is 2 simols task which can be 


performed by the central nonitoring site. 


Permecccer ee ntcranpe vt, Tite Histl gram 


The Packet Interarrcival Tine Histogram indicates the 
Number of packet interarrival times which fail into partic- 
ular time classes. An inteararrival tine is the time between 
consecutive carrier (network busy) signals. This mneasure- 
ment can assist in determining how mush the network is being 
us2d and what percentage of the tine the network is idle 
during a specified monitoring period. If a large percentage 
Serantetarrival times fail into a class which reccrds occu-~ 
mences of large interarctival timas, Sienette. oaS-Seie £5 
Seacliwde that, during the monitoring period in question, the 
network was not highly atilized. @hen taking these measure- 


ments from a céntrai monitoring sit2, considscation shoul? 


be given to the fact that the recorded interartivai times 
wili be slight] biasei due <t0 the propagation delays 
between the adaptors and the nonitorting site. In the high 


speed environment of a local area network, thes> delays area 


seen as péing negligible. 


7. Channel Acquisition Delay Historgan 


The Channel Acquisition Delay Histograam depicts the 
meme Spent by adaptors contending for and acquiring the 
channel. The channel asSquisition delay begins when an 
adaptor beccmes ready to transmit 2 packet and ands when th 
[west bat is transmittei iito the channel. pcluded is > 2il 
of the time spent deferring dué to 32 busy channel and th 


meme cTecovering and backiaz off from 9ns or more collisions. 
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From these measurements, #2 can identify for each interface, 
the number of packets whos= deferr2l times fell into various 
tine classes. When using a CSMA/ZD access protocol, it 
would be appropriate to assume that, under similar condi- 
tions, the distributions »f channel acquisition delay times 
for all adaptors should appear very nuch the sane. If there 
is some variation, this is a good iadication that some types 
of problem exists @ithin a particular aGaprTor. 
Additionally, the mean channel acquisition dalay time and 
it's associated standarci deviation can be determined From 
data contained in the histogram. The collection of this 
data must be accomplished py e2arth individual adaptor. 
Results of the measurements taken it each interface must 
then be forwarded to the central noiitoring site on demand, 


or at some prearranged tim:>. 


The Communicatior Delay Histogram indicates th 


(D 


delays that adaptors incur in communicating packets to thei 


"4 


destination. Theoretically, 2 soOnnunicatioa ielay becin 


(h) 


ju 


whan an criginai packet becomes reaiy for transmission an 
BY 
Mecinition, 2 communication delay excludes the time to 


ends when that packet is received by the destination. 


generate and commuricate 2n acknowledgment pasket back to 
th original sender. AS implenentei by the NBSNET, communi- 
cation delay is measured from the tine at which 4 packet is 
mesay £Or transmission uatil the last bit of the packet is 
transmitted onto the ch2ann21l. This v2lue is saved until the 
transmission is acknowledged, 2t which time 2 locai histo- 
gram is updated. From this it can be seen that measurements 


must be taken by the aiaptor and seat to the central noni- 


toring site upon demand oc at 2 orsdstermined time. Qe) 
this approach, the communication d2l2y time recorded will 
Meemeanciude che time tS propogats the signal <+o the 
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destination. This iS tak= ep hntS consideration when 
measuring ‘one hop! delay. Although similar to communica- 
tion delay, ‘one hop! dslay includes propagation delay time, 


and the time for the iestination to communicate it's 
acknowledgment back to th2 source. The delay, ccmmunica*ion 
or ‘one hopt, measured jiep2nds upon the goais and objectives 


of the measurement operation. 
9. Collision count Histogram 


Pieces cogeem tadicacess the number of collisz 
packet of any type encounters before being tran 

Interpretation of these statistics provides an indic 

enw etiacitency of a CSMA/CD protocol in allowing in 
to acquire «he channel. RecoObartny Sf COllIsSion antormea 
for each specific packet nust be astomplished at the loc 
level. Every time a pack2t is involved in 2 sollision, 3 
counter in the packet h¢aier is incrcamented by one. Upon 
pilecesstul transmission, the number of collisions incurred 
Meeene packet prior to transmission is read directly from 
the: packet header by the cantral monitoring Sco 
Transferring information in this maniac to “he cantral moni- 
toring site would regquirt2 a modification t9 the packet 
Format proposed in [Ref. 2]. LieseNOdLrtscatlon  Wolld 
rejuijre the inclusion cf a fisid for the number of colli- 
sions experienced DVeetehe “packet poilor t£> successful 


feamsizSsion. By combining collision coun* infsrmation fron 


pa 


throughout the network, the cantral asnitoring site is abia 
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approach requires that th2 object of the measurement opera- 
tion be defined, followed oy a statanent of the goals of ths 
measurement operation. Next, the parformance neasures that 
best characterize the are22 of the network under investiga- 
tion are selected. From this, ths measurement tools most 
appropriate for use in obdtaining tae required information 
from the network are idantified and implemented. 


Having concluded that it would be infeasible to identify 
ani provide rationaie for every neasurement that uld be 
taken from a local area natwork, a SCuss1oOn GCONnCocaningd a2 2 


measurements currently being taken 3n an operational local 
ar2a computer network was entered into. Ten performance 
reoorts implemented on the NBSNET wer explain2d and their 
relevance to the SPLICE LAN discussed. These reports were 
Hest Communication Hatrix, Group Ommunication Matrix, 
Packet Type Histogran, Data Pasket S$izé Histogran, 
mirewqhput-Utilization Distributisa, Packez Interarrival 
Time Histogram, Channel Aequisition Delay Histogzaa, 
memmatacetion Delay Histoyram, Collision Count Histogran, 
eee Transmission Count Histogran. 

mmemaues-7on , —"HOwW MUCh Of th> network traffic skhoult 
be meaSured?', was implicitly addrassed in our jiiscussion of 
meeeracial trartfic generators. Basically, two approaches 
exist. By measuring everything on tha network it would be 
mae seeole tO <“Otally emeconstruct the original traffic. Some 
Peeeoems @xiSt with this approach. First of all, there woulil 
bé @ prohibitive amount of storage required for the data 
collectec from the network. Saconily, the review and anal- 
ysis of this information wouli take an excessive amount of 
feeme. Finally, it may bs Found that adaptors ar2 spending an 
MesOpLOpriate amount of cine collecting and processing meas- 


urement data. 





The second approach to network measurement employs 3 
sampling technique. Here, perfornance measurements ars 
Constructed only from a sibset of the total packets tran- 
Siting the network. Measaremeants tan be ranioniy taken of 
the normal packets flowing on the network, or from thos2 
packets created explicitly for measurement pucposes by an 
Pyeeeenacict traffic generator. In the first cas3, no control 


Memexerc-sed OVer che pack2ts being transmittei] through the 


network. in the second tase, controi of the packets is 
possibile. Mime Naract ok Stacs ant benefits of artriceial 
traffic generators have b2en previdusiy discussed in this 


muesis and in (Ref. 12]. Heawice od Gust fication fcr she 
miglementetion of artifical traffic generators is provided 
by Tobagi in the statement, "Genacally, internal subnet 
Pec Ormance is better studied in a tontrolied traffic envi- 
Benmen= Lather than ih a2 ceai traffic enviaronnant”™ [ Ref. 6: 
pe. 14421}. 

me Cita=n 2 “EhOrough p2 tfiorna 3 
LAN, this researcher fe2ls that natwork 


> 
SOugenmesare Kn2OWn artifict 


must be abis Baten CG LOs0S Of 
th2 systen. PCmiieeM= Wenner as capa De Lity, Lt iS proposei 
Mee Geach adaptor be able t> funstidn as an artificial 
metre lc generator. Process activation, deactivation and 
parameter establishment w#ould be soatrolled by the central 
Meretorang site. Additisaally, it LS recommen 


specified monitoring perisis, the n? 


cr 
xy 
O 
ry 
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oO 
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wi 
ut 
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MQ 


bility *o measure every occurence of certain «ypes of 
events. oom Cageoats (Yi iS Geqm@saced in order to craate2 
fentous Matrices and histograms (2.j., Host Communicatioa 
Matrix, and Packet Type Histogram). 

The researcher does aot feel there exists an urgent 


rejuirement for an emulation capability. The conposiction of 


Meee oPLICE configuration has b22n established and is 
Meeyectea in fRef. 13}. Possibilities fer 2xpansion would 
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seam to be in the area of additional host processing capa- 
Perc yo. ft 2S thé Opinion of this researcher that the cont- 
rolled addition of processing capabilit Wade not tax the 
networks ability to satisfactorally deliver paskets. This 


conclusion is based on, ceview of a report dealing with the 


( 


performance evaluation of the Be hernet Walac2 computer 
network {Ref. 14], and on the assunption that there exists 
enough simiitarity betwean the SPLICE LAN and the Ethernet to 
justify a conclusion of similar pacformance under increased 


meeding conditiogs. 


is 
(i) 


+ is recommended taat the t2n meas 


ry 
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te 
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x 
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sor 
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discussed in this Chapter be adopted as the ba 


4 


Ss 
the . measurement capability for tha SPLICE LAN be aks D= 


meshed. It is the opinion of this researcher that these 


( 


( 


mepOres Provide an accurat> andi faicly comprehensive victura 
of network performance which can bs utilized by overations 
personnei in managing tha network. Additional measurement 
BevOrts thet coulbd augment taose alnpeady prasenced would 
Possess the ability to neasure cespoise tin S 

Mene Weil ization, characters 2nd on 

per unit time, average ialay, and softtwa 

burfer counts such as in adaptors ani shared rasoi 


u 
Uses for measurements taken from a Computer network 
u 


include performance analysis, and component failure identi- 
imeeoeion, isolation, ani testing. The degre2 of success 
achieved in the accomplishment of these tasks is hight 
dependent upon 2 comprehansive ani ccurat2? measurement 
Beocality. To EeiSure this ease GImeenues tO 3 
provided throughout the life of thea astwork, it is impera- 
tive that ‘the measureman: softwares incorporat2 a flexidle 


design in order to accomilate expansion of, and nodification 


to the measurement tools. 
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IV. NETWORK PERFORMANCE ANALYSIS AND COMPONENT FAILURE 


In Chapter 2 we presanted andi jiscussed various noni- 
toring methodologies. The concept of network measurement 
was ther undertaken in Tthapter 3. Using the knowledges 
imparted by these Chapters, we can now discuss the topics of 
network performance analysis and comoonent failure handling. 
Basically, netwerk performance analysis is concerned with 
evaluating data and statistical fsopo9rt obtained by tha 
network's measurement function. ising (cthrs evaluation 
process, measurements are scrutiniz2i for signs of component 
Baadure end inefficient natwork functioning. Additionally, 
pecformance analysis of the natwork allows us to: adjust 


network performance paraneters in order <5 ‘tune’ the 


network, plan for network growth, and identify bottlenecks 
at various components throughout the systen. mo) > vous 
Giscussion, the concept sf failurs has been amore broadly 
meme a tO include the network's inability to provide timely 
service to it's users. What this m3ans is that degradation 
oft selected perrormanc: msasuces, such as Network 
m= oughput, te Ueeewec 25 Sire cd as agefat lucas within the 
network. 


Gpeteally, a discussion daaling with the question, ‘At 
what time should the verformanzce ayalysis take place?', is 
eeeered nto. We then 199k at the function of performance 
analysis as 1 pertains > a local area computer network. 
Finally, a presentation andi evaluatioa of various +echniques 
used in the detection and diagnosis of network componenx 


Paz luce is under*aken. 
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A. PERFORMANCE ANALYSIS [PIMINS 


There are three tine fram2?s in which performance anal- 
ysis can take place. These ar2 oi-lines, off-line, and 
instantaneously. Off-Line analysis r¢équires the evaluation 
of performance measurements to tak2 place upon completion of 
tha monitoring period. On-lin2 analysis enables the evalua- 
tion to take place during the nonitoring period. Evaluating 
data at this time implys a delay between the generation of 
the measurements, their analysis, and subseguent actions 
taken as a result of this analysis. Instantan2ous analysis 
is accomplished through the us2 of dynamic control programs. 
These programs provide for tha iamediate ayalysis of data 
and statistical reports, followed by any corrective action 
that may be required. 


Ve Ott-Lame Amaiysis 


Ofi-line analysis implys that the records generated 
by the monitoring systen are plac2di in mass storage for 
Fucure analysis. Perfornance an2lysis is accomplished in 


(p 


ls way by the NBSNET [Ref. 8]. 


¥ 
i Delay in GOtrective 2ction 
Anitiation due *9 off-line analysis 


experienced by tha 


= 


BSNET was 5-10 minutes [Ref 8: p. 726jJe Implanenting chis 
'method' of performance analysis provides the analyst with 
@aemadl icty to obtain an overall picture of network perforn- 


ance before making any otherwise ras1i parameter adjustments. 


This méthod also allows a nore iadtpth analysis of the 
performance measurements through the use of off-line testing 
and evaluation programs. Pts oma sSsason for the = 


of off-iine analysis is basei upon the speed of the LA 
The high rate at which packets ars transmit<3]i means th 
thare is only a small amount of tims ¢9 Simultaneously assi- 
Milate the data and creat? statistical revorts upon which <o 


act. The major problem associated with off-lin= analysis is 


a 





iz<'s lack of responsiveness. As a c2sult of tha speed of 3 
LAN, the environment whith was cacsorded during the moni- 
toring period may not exist upon completion of the analysis. 
Therefore, any adjustments to the parameters based upon the 
analysis may nce longer be applicabie to the current 


environment. 


2. On-Line Analysis 


Cn-line rerformans2 analysis e2nables network opera- 
tors to capitalize on the benefits offered by a real tins 
conaputational environment. Althoagh the degree 
on-line performance analysis is currently practiced 
Los Alamos integrated Comnanicatioas Network [Ref. 21], and 
th2 Lawrence Livermore National Laboratory Octopus Network 
fRef. 24). Additionally, the toiex Distributed Network 
Controi Systems 200 and 300 utiliz® an on-lin2? approach to 
pecformance analysis [Ref 25]. This ‘method! of analysis 
Peavides for: @more innediate datection, jilagnosis and 
Memsec.:On OF network fallurs, 2 greater utilization o£ 
advanced graphic capabilities for nonitoring the network, 
ani an increased use of iJ3acision support capabiiities which 
Gan provide the operator with sugg3sted coursss of actior 
and adjustments to network performanc2 parameters. Two main 
problems exist with this approach. PEOSt, human incervena- 
tion is still required for the aijustment of parameters 
inorder +o modify specific network performance measures. 
Ani second, there remains consideraole delay, with respect 
to the speed of a local ireéea somputer network, between ths 
Capture of network perfornance measurements and subsequent 


meron cc effect their values. 
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It is the researchers Opinion that the implementa- 
tion of an instantanesus perfornanace analysis capability 
could theoretically optimize the 2fficiency and effective- 
ness in which network evaluation is conducted. Networks 
that have implemented or plan to implement an instantaneous 
performance analysis capability are the Ethernet [Ref. 14: 
p. 717], and the Defense Jata Network [ Ref. 19: p. 4J. This 
technique allows network operations personnel to establish 
ranges within which perfornance measir2s may vary. If mneas- 
ures for which ranges have been established breech these 
eeederined linix« Guring normal network operations, an 
interrupt can be generated which initiates a progran 
designed to bring the value of the performanc>= measurement 
back within the prescribei range. [1 this way we are takiag 
maximum advantage of the computers aoility to process infor- 
mation almost instantan2susly Pierce hereby OrOvViding an 
immediate respense fa CUZESRCU network Con dae ons. 
le@eeeatitanecous analysis ani dynamics sontrol of a network is 
Mmomeenger just a theoretical toncenpt. AcGvanced inszalla- 
meors canh now oifer StLgnificantly simplified or even 
mieemat tc InceSErVention suth as automatic restarts, automatic 
renote-site monitoring, ard Slesteon 2c BSsOnriguraton 
feet. 20: p. 10]. The major problen with this technique is 
that there exists a loss 9f explicit control of the network 
by operations personnel as the monitoring, performance anal- 
ysls, and parameter aijustnent become mores automated. 
Additionally, uniess st3ps are taken to insures orvherwise, 
th? automation of these procedures nay well dseorivs network 
Opsetaters of information concerning just what is happening 


Paseaqe the network. 
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B. LAN PERFORMANCE ANALYSIS 


Performance is the property of a system that: it works, 
it is responsive, and that it is available ({Ref. 15: p. 4]. 
Given this, our performanze analysis techniqu2 must enable 
us to ascertain that thes2 characteristics are accomplished 
in the most efficient manner possible By implementing 32 
performance analysis capability, we hope to cbtain informa- 
meron that: can be utilizeji to increase system responsiveness 


= 


mae creicability, wil assist in capacity planning, 


{bb 


a 
od 


gap 


reduce network operating costs. Real tO Ras weyn, Gra Cee 
network performance will assist o2992rators in pinpointing 


more precisely the nature 9f a failure, thereby helping to 


- 


SOrbect 1 quicker and caducs conodnent downtime. This 


t 


section includes the idantification of those performanc 


f 


metrics that have been s2lected by the researcher as those 


i 


Mien Cam b= most effectively utilized in the analysis of 
SPLICE LAN performance. Mad2ttons liv, a discussion of 
performance parameter Paes Gitsescion and selection is 


undertaken. 


fice Performance 


Cem Zang se .he information orovided by the tan 
reports explained in Chapt2r 3, we ace able to effectively 
@aniayz2 the perfcrmance of the LAN. The question that must 
be answered now is, ‘What measures d> we look at, and how ds 
we combine them +5 insure a complat2 and accurate rzepresen- 
BacetcCn cil «he network's parfotnancs is obtained?'. 

The selection 2ni combination of measurements for 
the purpose of network parfornance analysis is based upon 
the goais and objectives 29f the peading evaluation. UE 
emphasis will be on using performanzt2 analysis to assist in 
component failure detection ani in inproving the operational 


mimetioning of the network. ESewenss5£0 OCCUL, 2cceptabis 


=o 





Bemges £OL Critical perfdsrmance “Weasures unier specific 
network loading conditions and confijzyurations must be estab- 
lished. These ranges may be estabiished and kept in tables 
by using analytical models to dynanically datermine theses 
ranges at defined intervals for uss in comparison against 
actual measured performances. Values of critical performance 
measurements which do not fall within established limits 


should cause an interrupt to b2 jganerated which inturna 


om 
(D 


initiates some form of ranedial action on the part cf ¢t 


system. Beiae memo = coum ARnlAlLo Sxelici® comezrol 


O 
rh 


= 


the systen, network operations perssanel must be one ie) 


(D 


i 

rw) 

p 
= 


ability to establish and s2t the raiges for these crite 


tt 

}-*- 

ct 
0 


py 
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and predefine certain valu2s taken from the network Cc 


x 
}- 
t- 
Co 
(D 


Mmeyi when hey occur, such that the occurrence 
Bexmight immediately to thsir att2ntida. 


Many possible conbinations 5£f performance measure- 


ments exist. Wetcalfe ani Bogjs [R2af. 183 pe. SOT], utilized 
Meme Giees ta CLS acgquiSition probaoility (the probability 
that exactly one station attempts a transmission and 
acyuires the channel), wait tine (the mean tine a packer 


must wait before successfully acquiring the channel) and 
Sommnel efficiency (that fraction of tin 
cacrying good packets) z> evaluate the p 
Ethernet. This approasth is more of an 2 
and, in the opinion of th researsh2r, seems £9 be limited 
in its usefulness in an oosrational 2avironment. 

Another possible combination was suggested by Tobagi 
in a presentation at #13 Naval Postgraduat2 School in 
Mommectey California on the 21st of Jctober 1982. One of the 
topics addressed in tha 


presentatioa dealt with identifica- 


re 


te 
tion and utilization of oyverformancs measures for a local 


Ww 


ar2a computer network. These res wer:: bandwidth 


=2,> 


O S 
pan 
3 


0 
Meee catiOn, SyYSt2m capacity utilizati and message delay. 


ByepoecekKing these down int more specific mnoritoring areas, 
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we are provided with the ability to obtain a comprehensive 
picture of network oecformance. These disaggregated 
performance measures fall into two sategories. mae firse 
category provides for the evaluation of the networks commu- 
Mmeoetion Capability and inslud?s as criteria: throughput , 
response time, and file transfer rate. The setond catagory 
provides for the evaluation of resource utilization 
enroughout the network ani includes: processor utiliization, 
memes Wut lization, ard liaeé utilization [Ref. 16: p. 48]. 
The combination c& these measurements, together with control 
of the parameters which effect their values, 2nable network 
Op2rations personnel or iynamic control prograas to detect 
degrading network perfornance and ¢2k2 appropriate corre 


mivge action. 


PeeececboeG@ance Paranste 
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FOllowing the selection Se 


appropriate network 
ust be identified which 


pecformarce measures, Dirameters 
can be adjusted in ordarto a values taken on by 
these measurements. Thes= parametscs and their associated 
values should be chosen on the basis sf existing analytical 
and simulation results 2s weil as previous experiments 
Bemeed OUT In Vabiecd traffis conditions [Ref. 22]. The 
researcher feels that onts the parameters that affect the 
value of a specific performance neaisure have been identi- 
fod, maey Shem d pe df 2OTLcized. Diese Deo ObLeiZa21on 
Should be based upon the parameters affect cn the perforn- 
ance measurement for a yliven systen configuration. hss 
Suggests that there may 2xist diff 


a 


MIDE Or? 2 Zac] OnS Or 


w Pp 


SiemPabamet ers for different sonfigurations of the network. 
Mmem possi blS prioritization schems might call for the 
adjustment or those paramaters first which have the greatest 
etfect or the value of the oerfornance neasurement. An 


a 


smportant fact tha+ should b= considered when seiecting, 





prioritizing, and adjusting parameters is that the majority 
of performance measurements ani paran2ters are interrelated. 
Foc example, an adjustment made to increase throughput, such 
as increasing the size of the packet data fieli, will also 
effect the delay experienced by the aetwork user. 

Finally, there ar2 many parameters which can affect 
on2 performance measurement. Likewise, the adjustment of 
‘On2 parameter is capable of affectiny nany performance meas- 
ures. This being the casa, it woull be extremaly difficult 
at this time to attempt 2 listing 29£ all those parameters 
Which aifect the valu2s of the parformance measures we 
presented above. Rather, these would be moce accurately 
identified through the us= of Sinulation, poeeling, and 


experimentation. in _ One Sippot identity a single 


a 


tunable parameter whic Peace ly S2eeccs one Sopsellis 
performance cnaracterizing measure Instead, 2n2 can idén- 
tify the two sets (parameters ani neasures), and zhrough 


experimentaton, define thair intersertions [Ref. 26: p. 1]. 


C. COMPONENT FAILORE 


Along With managing the local area network-ionghaul 
network interface, component failures distection and diagnosis 
is seen as th2 most important function of network manage- 
ment. The ability to provid= users with a responsive, 
Myvedlable network 1S of primary impodctance. he: dO hes, 442 
must be able to quickly datect and diagnos network failures. 
Having this capability will allow tas system to immediatly 
initiate appropriate recovery proteiur2s and restor2 full 
memes tO 2t's users. Tais section will addrass the <copics 
Gee, component failure jietection, ffieore<diagniosis, and 


reporting of the faillura throughout tha network. 





A failure detection functisn should enable network 
operators to recegnize operating ani configuration problems 
immediately so they can interven? in a timely fashion to 
correct them {[Ref. 20:3 pe. 10]. Not only do w2 want to be 
maie aware of catastrophic failures, but also of gradually 
failing conditions. It is a wall dasigned performance anal- 
ysis capability that enables us to ba aware of the latter. 

GConmponenm saltluce 1etescion Within a 1ldcali computer 
network can occur in many ways. P>a>bably the most simple 
being a face to face encounter between a user and network 
Operator, the subject sf discussion being either an inoper- 
able component or unsatisfactory network service. A pnone 
call from a remote user 15 another m2thod of detection. We 
can also see a network oparator laboriously reviewing systen 
Begesstic reports for sigis of degraiing pexfornance. From 
th2se pasSive monitoring tachniques which required sxtensive 
op2rator intervention, th2 emphasis has shifted and is now 


On automatic alerts based on equipmeat failures, and in mora 
i 


Beemasticated applications, also on user-defiied limits on 
Sush items as ‘transmission volanes and response “ims 
Mest. 205; pe 10). Impl2mentation of an autonatic failura 


@em@ection capabiiity is csurrantly being planned for the 
Defense Data Network [Ref. 19: p. 7]. 

It is not the researcher's intent +o suggest that 
all, or any subset of th detection nethods to be presente 
pelow should be automated. Rather, the authoe's approach 
Will be to idantify ani discuss 22ssible tachniques of 
failure detection, understanding tiat their implementation 
Samgid sake a variety of forms. | 
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ae M@intenance D2tection 


Failures can be idantified through normal 
network maintenance activities. Thes2 activities may be 
unier operator or prograz control and may occur at prede- 
fined intervals or on an 35 ne2aded b3isis. For axample, in 
the process of updating the csonfigiration data base, the 
nead may arise to poll- all componants within the nstwork. 
No resonse from a particular elemant may indicate the éxis- 
tance of a failure. Additionally, the failure to receive 4a 
Peyuired maintenance of status raport froma component is 
another indicaticn that a problem nay exis*. Testing the 
Seeeatton of the network utilizing artificial traffic gener- 
ation may also lead to the discovery of network 
inefficiencies. Finally, the us= of watchdog packets 
fRef. 8: p. 727] to verify active ani inactive tomponents is 
meso a Viable teo1 chat can be used in identifying failing 


elaments. 
b. Performance A1ralysis Dat2ction 


Mommemn che tLessqarcher's Spliniton that the major 
benefit to be gained from the perfornance analysis of a LAN, 


is the added capability it gives Network operations 
personnel in devtecting failed composienis. Status report 


in 


(D 


generated by individual components, ind those craated by th 
Centrel monitoring site san be reviewed for: changes of 
State, obvious trends, and arratiz> tomponent performance. 
Adiitionally, component arror counts can be reviewed for 
Megeadsng conditions. [Two systems which us3 2pproaches 
Similar to these are SNA “Ref. 27: 9d. 12), and the Arpanet 
hGe, [{Rert. 23: Pp. 6-6 j. 


In 5NA, record Maintenances 
Statistics are generatei oeriodically and sent to 


h 


co1trol point where they are iogjgei and scanned to dexec 


ct 
iD 


ct 


degrading component periormance. In the Arpanét, IMP! 


() 
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examine their own status and send r2ports to the NCC every 
Minute. Finally, by monitoring th2 availability of a compo- 
nent, which is defined as the mean time between failure 
(MIFB) divided by (the M[IBF plus the mean time to repair 
(MZTR)), we are able to datect a very gradual degradation of 
that component's ability to perform it's function over an 


extended period of time. 
Ge Localized DStss tion 


Dewees on Of 2° = ithin a ccnponent can bs 


ela Ww 
accomplished by the compon2nt itself, assuming the failure 
is not a catastrophic on2. A trap mechanism within an 
adaptor or component interface is a 'devicea' which is acti- 
vated whenever a certain raardware falLlure occurés or a block 
of code is executed. This méchanisa not only detects tha 


peo bien, but Can used ts initiate sone type of diagnostic or 


corrective acticn. Hariware devises are also used for 

probiem detection at local levels. fhe Arpanet IMP hardware 

-s capable of automatizsally datecting power failures 

(R2£. 233: pp. 6-5], whiie the Ethsenet amploys 2 watchdog 

tiner which disconnects ta2 transceiver from the channel if 

mest abesS 2ccing suspiciosisly Ref. 18: p. 20]. One final 
C 


method of iocal failure datection is accomplished by estab- 
lishing a maxinun hunger of =SUays eo packst 
transmission. After a MNaXimum OF 15 retrys tds *ransmit 3 
Maeket, a transmitter on the Ethar1s% gives up and reports 
Bitemcaiviure condition [Ref. 17: pe. 2)]. 

petoerImGd cia, tasture SE an adaptor's attached 
component and any peériphacals associated with it is also 3a 
requirement. Detecting tae failure 2f an adaptors attached 
component can be accomplished through the usa of an inac- 
fovety timer. Mew pNEpose Of this timer is &¢5 Signal the 
pessibility that the attached conponent may have failed. 


Once the timer tuns down, action is initiated to verify the 


og 





status of the component. iheeest wb Ssultes indicate that the 
component is down, theve2ntlal Monitoring site is notified. 
Finally, it is assumed that failure jiatection of peripherals 
attached to the network component will be accomplished by 


that component. However, the regiirement exists that the 
status cf these peripherals be acs2ssible to Local failures 
detection routines inorier that tha central monitoring sita 


may be kept aware of thairc coniition 
G. Neighbor Detestion 


If anode experianc2s a2 catastrophic failurs 
Pesenouc being abls ¢o notify the caitral monitoring site of 
the impending doom, then w2 must have 32 method by which this 
Failure can be detect2d and the s2ntral monitoring sit? 
Meeatied. At the local level (.1.23. without assistance from 
the central monitor) ther2 exist 2 possibilities, both of 
which are based on the assumption tiat the failed node was 
involved in a session when the failur2 occured, or, that 
sone other node will attenpt t> initiate a session with “*h2 
failed nede within a reasonable amdunt of tinea after the 
mailLure. Assuming thes 129de in gqu2stion is involved ina 
session, there exist two anethods of detection. Theo fi2st 
method involves th2 maximum number 32f times a packet will b2 
transmitted without receiving an acknowledgement. iis 
ducing a session, a packet is successfully transmitted the 
maximum number of times without ces2iving an acknowledge- 
ment, then the transmitting station can assume the 
Meecanatiton is down and notify tha santral monitoring site. 
memelarly, if the destination nois stops receiving packsts 
from the source node withsut getting an end of nessage indi- 
cation, i1t can assume the source has failed and notify the 
monitoring site. Finally, the techniyue based on nonreceipt 
of acknowledgements can 2lso be us2i when on? station is 


Mesemp.o2sng £5 2stablish a session with another station. 
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Once a failur2= has been jilatected, it must be 
located, and it's cause i2termined. These ar2 the primary 
objectives of a failure jliagnosis finction. Phas Lunction 


May be automated such that the detection of a failure initi- 
at2s a program which perfroms various diagnostic routines in 
support of the accomplishment of these objectives. The 
Defense Data Natwork utilizes an apocoach similar to this. 
As planned, the DDN Monitoring Canters will be capable of 
automatically monitoring network alements t2 identify, 
isolate, and sometimes correct problems without specialized 
maintenance personnel involvement. 

When Gesigning 2 set of diagnostic tools it should 
be noted that, fcr some diagnostic t2sts and routines, moni- 
toring and normal data traffic flow may b2 suspended. 
Assuming this to be the rule rathec than ths exception, 
Maonosuwac tools should bs develops] accordingly. In the 
mebl@Wwing Sect2ons we will identify and discuss a number of 


these tools. 
ae Tests and Traps 


Diced TLagnostic gescograms can be utilized 
to initiate specific tests in areas »f the failed component. 
Adiitionailly, traps can be utilized to activate thess 
programs once a failure has been datested. Tests conducted 
on the compcnent might include checking all physical connec- 
tions the component has with other lavices andi comparing 32 
block of cod2 in the cojmoonent wita an imaga2 of what thar 


code skould be. 
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be. Interface Looping 


hea ooummcreatmost2ecetool £5m a network interfaces 
Memene abiiity cf a nod= to send sackets to itself. In 
iving a node the ability to transmit and simultaneously 
receive the transmitted packats, «#2 are able to obtain 
complete verification of the network interfacs. Mis is 
where our artificial traffic generatosr comes into use. We 
can generate a stream of packetS with Known content, and 
size and arrival distributions. By checking the returning 
#+raffic against what was just generated, we can identify any 


problems wrich may exist 11 our network interface. 
Ge Dytanc Diagnostic Tool (0DT) 


The use of a Dynamic Diagnostic (52 Debugging) 
Mool Was introduced by th Arpanet VOC [Ref. 23: pe. 6-5]. 
The DDT is a set of software prograns which are utilized in 
an effort to diagnos th cause of 2 component failure. The 
DDT may be local to, orf transmittsi to the masthine associ- 
atad with the failed compsient. DOT can be us2d to perforn 
a number of tests and Operations geaced towards determining 
tha cause of a component failure, th2s2e include: the exami- 
meen and modification of 2 specific word in memory, 
cl2aring an entire block 3s nmemory, searching néemory for 3 
M@aeetcular stored value, 2Xamining the contents of specific 
Pieters and modifying thair contents, measurement of 3 
@evece's realtime clock, and implanting traps and interrupt 
handlers in a device susp3ctel of having software or hard- 


ware problems. 


d. Dump and Load 


ime Grn=r diagnostic methods faii to deter- 
[men tnes cause of a failare, one final course of action 
exists. The entire contents 29f maia nemory existing within 
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the component at the time of failurcs is dumped to off-line 
storage where additional diagnosis and analysis can be 
conducted. Simultaneously, a new copy of the appropriate 
software is loaded into tie componeit. If this procedures 
Peel f£arls to correct ths problem or bring the device back 
on-line, it can ke assunei, with a high degree sf certainty, 
that a hardware problem 2xists and contact of appropriat? 


vendor personnel is in ori:r. 


3. 


("34 


ge lucS Neel fi cate 3 


We now address ‘*th2 qusstion, 'Who is notified and 
what data bases are updat2d upon the detection of a failed 
component?', Assuming dstection ani diagnosis were accon- 
plished by a distribut2d somponant (relative Zon eae 
momecOLing Sits) in the nstwork, the central monitoring site 
Beira be <he first enticy Notmmeewed Of the tailure. 
Pemeistically, notification of ths various eatities to be 
identified below, could h29pen simultaneously, oc nearly so. 
It would then be the responsibility of the central moni- 
Mmerang s..e to notify aiditional antities and t pdate the 
edad by <ne 


central monitoring site ia basically <=wo ways, either by 


5 *u 
appropriate data bases. These data bases are updat 


Op2ratons personnel or oy a progcan which automatically 


makes entries into the aporopriat? iata bases upon receipt 


of failure alert messages. The data bases that must 2 
upiated icnciude: the configuration data bass, ‘the problen 
Management data base, ani 2a histocical data base which is 
utilized as a means through whith the evolution cf tha 


network can be tracked. 


3 


There are a number of additional entities which must 
Scum emech= —Getectidan SE a failed component. 
n re u 

c 


fe 
To begin with, if monitoring sit3 personnel we 
ap 


2 unable to 
restore the failed compon2nt, than the propriate vendor 
must be cont2cted. Pose Seno Sf tho bAaN Will be notified of 
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the failure by the problen managem2it data bas or confignu- 
ration management data base when thsy log ontos the network, 
or when they attempt t> utilize the resources normally 
provided by that component... Users attempting t> utilize the 
rescurces of the failed component from a g22graphically 
dispersed site through tie DDN will be notified of thes 
failure in a manner analogous to i 9cta1 users once they have 
maie contact with the LAN. Finally, those members of the 
op2rations staff who may 92 in the process of conducting any 
Pee OL SxXPSrlgenzs cr monitocing astivities which includes 
m= faired component aust be explicitly notified of the 


@entiguration change. 


D. CHAPTER SUMMARY 


we began this Chapter wit a descussion of the possibis 


tine frames in which network pecformance analysis could 
Bes urer Those discusseji were2: 9ff-line, on-line, and 
instantaneous analysis. The topic of local area network 


performance analysis was then entearei into. In this section 
we discussed performanc)2 neasure utilization ani performance 
parameter selection. A ocesentatio1 oof various metheds of 
component failure detection and di2gnosis concludjied the body 
ef the Chapter. 

It :s the researchar's opinion that a SPLICE LAN could 
benetict from each type of analysis. Instantan2.us analysis 
Semi1d be utilized to evaluate and effect the parformance of 
the network layer protocol ani balows. Bees would reduce 
management overhead in that personnes! would not be needed ¢=9 
Constantly monitor network status via a CRT, Jr to review 
olde analyze printouts reflecting the networks condition. 
Foc ¢xample, adjustments nade to increase throughput during 
tines of network congestion, such 2s modifying our backoff 


technique, would be accomplished by a progran rather than 
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reguiring human intervantion. Jverhead costs associated 
with the running of these programs would have to be compared 
agzinst the costs incurr3d by non-automatedi and semi- 
automatic procedures in order that efficient and cost 
effective functional implenentation is achieved. An on-lins 
analysis capability would give the sp2rator a window “«hrough 
which the functioning of th2 natwork could b= observed. 
Through the us2 of some sort of decision support system, che 
Operator could obtain assistance, 99ssibly in the form 


9 
eu@agestsd action OF in aljusting sarameters which e¢efrect 


global perrtormance measures. QEF-line analysis wouldi 
Provide operators with tn2 ability ts analyze the perforn- 
mise Of «he network in an @nvironneant seperate from the 
system. This 'method! would remove any pressure that might 
be experienced by the »sp2rator wheaa attempting +9 analyz 


performarce while cn-lins. 


The performance measur2?s suggest2i by the author for the 
SPLICE LAN are severated into’ two tatagories. Deas ia 
megesy Provides Zor ths Svaiuszcion sf the network's commu- 
Meese 200 Capability. Tha second catagory inclades measures 
which can be used > evaluate resource utilization 
throughout the network. Fach of these was jescribed in 
Metaczl SCarizer in the cThaoter. Raaig 


Ss 
2s for these neasures 
mould be determined dynanically during network operation, 
nowever, network overations personnal must be able to over- 
ride dynamic range establishment a1i11 set <thaic own range 
values as nesded. Numerous oaran2tecr ist which can ba 


= 


S 2x 
MUrilized to effect the values 5f thes2 perf 


(D 


Ee 


ra 


ance measures. 
Beeecr than proposing a list of tunable par ys ae oY 
+ 


m S 
ee's Very nature would o3 incomplete Eeadeuor OLLsrs 


o 


mijjene SUgGgeSt ions for thelr identification and utilization. 
Th2se¢ parameters and th2ir associated values should be 
established on the basis 3 — tev elci!  modsis and 
Simul 


ation result as well aS operational experimentation. 





Onz= identified, these parameters should be prioritized in 3a 
Manner which reflects their effect 20 specifics pertormanc? 
measurements. Finally, the fact that adjustment of on? 
parameter may effect the value of more than one performance 
measure must be considered in selection and implementation 
of the parameter. 

Our discussion of a failure jatection and diagnesis 


capability as part of the SPLICE LAN will smphasis ths 
limiting of these capasilities possessed by components 
Oeste ributed *hroughout ths network. Phe facts s aS 2ee 202 
Memeo lscy Of a distributed component is linited to tha 
Meentification of those f2ilur2as which cannot be detected by 
the central monitoring site. The liagnosis <capability is 
also to be similarly restricted. [It is the cesearcher's 


penton that “his approach will redica diagnostic software? 
duplication throughout ths network, 2liminate naintenance on 
fers puted diagnostic tools, and Egveqe £OG NOES ,central 
SBemezOl Of fEaiiure analysis and proolem na 2 
Getecting 2 failure, the component will send some forn of 
Pegepvem el_ert nessage t> the cantral nonitoring site. Fron 
ei2c PpOLnt, tne actions taken by On vor 
idanticai to those that it would taka if ith 
marlure. Since we have Limited th Geilo n 
MoeaeilLaty of the distriouted conpsi2nts, conv 
Mist increase those of the central nonitoring si 


felt that periodic status reports such as *hose 


J 
Maimprer 3 should be sent ¢5 ths central monitoring site on 2 
meqgular basis . There they can b2 analyzed for possible 
Signs of component failur2 and systen degradation. In addi- 
tion to those se iciss abtuged tSe2bove, chs monitecring 
Site must be able to direct th2> transmission of status 
Bepoegts crrom distributed network csconoonents to itself. ie 
must possess a diagnostic tool Mieecan be utilized 


Z 
throughout the network to isolate ani identify failures in 2 





Manner Similar to that of the DDI suployed by the Arpanet 
Network Control Center. Yore details concerning the func- 
tioning cf a central monitoring sit2 will be discussed in 
Chapter 6. few Simemcrleatite eo Conclude at this time that, 
by centralizing the majority of thea nostwork's failure detec- 
tion and diagnositic capabilities, wa are increasing control 
of the failure handling procedures of the network, reducing 
software duplication and naint2nanc3, and mininizing costs 
associated with the impl2nentation of a failure detection 


ema d#eagqrnostic function. 
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V. MANAGING PHE LAN/DDN INTERFACE 


As stated in Chapter 4, Slolgewt hn faiuresiaentirtica- 
mornand Correction, th2 most important function of LAN 
Management is the monitoring and control of the local area 
network to long haul natwork interface. Theisen ct Loni s 
orimarily concerned with regulatingy the flow of packets 
between the networks ani any other tasks which support it's 
accomplishment. In this thapter, onc emphasis will be on 
identifying and discussing the manajg2riai aspects associated 
with the interconnection 2f two networks. 

Merundatental aspect Of internstwork communication is 
th establishment of agrezi upon conventions. Communicating 
entities must share some physical transmission medium and 
thay must use common conventions dr agreed upon translation 
mepmods ~fRef. 29: pe. 1392]. Ritcme ase Sd icoOnnmOnalIty can 
be achieved in a number of ways. PEeTOeCOlS SE One REt Can 
be translated into thos 2€ anoth2r, or, comacn protocols 
could be defined. Another method through which commonality 
may be achieved calls for tonversion t9 a stani2cd intarface 
Byeail networks. Tt is the cesearcher's opinion that «the 
connection of long haul natworks +9 Local area networks does 
met lend itself t> tha sastablishnent cf common protocols 
gee WOUld be efficient for both n2tworks. Aaa Lona lily, 
fie benefit to be derivei from coavertin > a GS22ndard 
interface is only realizei if a network is connected to mors 
meram cne other network. Pec Ondtceucamcomonly one network, 
Meet Zzing a standard intsarcface would requires two pr 
epanisiat-ions. NetwWOEk "Ass DEPococol would require tr 
Meme onto a Standard intscfaca protdcol which W 
meafuere translation into natwork B'S “protocol upon 

1g 


at “he connected network. Where2:as, =he us2 oO 
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Beansiat=on would only rcequire the conversion of A'fs 
prewocol to B'S; or Vice versa, depeiding upon the direction 
of packet flow. Therefor2, we will consider the issue of 
Managing the interface between two oaetworks from *he stand- 
point of protocol conversion, rather than from common 
protocol or standard interface establishment. 

There are many differences which sxist between networks 
that must be resolved, those that will be covered in detail 


mee cnis Chapter include: naming aad addressing, flow and 
Seages<2¢e¢n control, Sac@ee Size, and” “acece®=sss gecon==ol. 


Additional areas to be discussed will encompass gateway 
configuration, i internetwock accounting, and dispersal of 


network status information. 


A. GATEWAY CONFIGURATION 


In an effort to set the stage for a discussion dealing 
With the management of an interface between two networks, it 
Memreit that ah understaniing of possible gateway configura- 
meons, @= Levels of aAntereconnestion as dubo2ed by Cerf 
[eee 29° pe. 1392}, will prove baneficial. There are 2 
variety of different ways in whith the gateway between two 
packet switched networks may be sonfigured [R2f. 28: De 
G=49)]. We will briefly describe each one and discuss why it 
emerlaq, Or why it should not.be coisidered f52 the SPLICE 
met work. Finally, for explanitory purposes, w2 will select 
a configuration and use it as an 3xample throughout th2 
Chapter. 

fj hoceng 2 common host 15 4a Simple and very straigh+ 
Meeward approach that can be used t5 connect two networks. 
Mees Method connects two networks through a host that is 
attached +o the two networks. fice glratlon- can bs 
ruled out immediately from csonsidtration for the SPLICE 


nstwork. This is because the antir2 SPLICE program is bassi 
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upon relieving the host (s) Of mmeonnunication cespsnsibili- 
ties. To burden the host computac with anything but the 
processing of application programs would be entirely against 
mae) SPLICE concept. 

Another approach to interconnactting packet switching 
networks would be to have a switching node which is common 
eorpoth of them. This aathod must also be ruled out from 
. corisideration. First of all , the LAN does not possess 3 
Switching node. An att2napt night be made to combine the 
Bates 2On=s of a DDN switching neda2 and the LAN front end 
processor (FEP). Although a techaisally feasible solution, 
the drawbacks are major andi numerous. 

An internode device can be used 4S a Separate entity 9 
perform only gateway functions between eéach of the networks 
to be interconnected. This gateway 1s normally desiqned to 
appear aS a special host to each n2twork. [This approach 
provides the most acceptaole alternatives, however it is thea 
Biewor’sS Opinion that ths requicemerit for additional hard- 
Meee cO perform the intersonnection Sf two networks is not 


SUpportive or the SPLICE sonceo 


- 


ct 


= 

Maes f£ifald possibiiity for Aa gateway configuration 
utllizes the existing capabilities »9f a DDN switching node 
(IMP), and the jJocal are2 network FED. ties .cOnEtqura.1on 
is Calied the "two half-gateway". In the "two half-gateway" 
approach, a gateway is conposei of two halves, éach associ- 
ced with it's own network. Each half-gateway would only bs 
responsible for translating between the internal packs+ 


Boaemat Of it's own metwork and son2 common internetwork 


is a 
(D 


format. z number and iifferent types of networks “he DDN 
feesemantO Willi dictate wheather or not an approach of this 
nature is optimnun. (Ieee Meron ne Slapdard inter= 
network format has been proposed. [This being the case, 3 


Bivoh= modification to this approaca should make it usable 


ou 


eee = =aciSnt LOL connestiig a SPLIZE local area network <o 


7) 





the DDN. This change would requir2 2 conversion from the 
MOE Ehae  DrOtogcCOL(S) 2£ the local area network to the 
protocol(s) of the Defense Data Natwork and vice versa, 
depending on the direction the packets are flowing. 

For the remainder of this Chaptar, we will utilize the 
Nevo half-gqateway" as our basis for 2xplaining the differ- 
enzes that must be overcome shen connecting two networks, 
and the functions which must ba acsouaplished by the gateway. 
ror our discussion, it may nelp ¢t9 picture on2 half of the 


gateway implemented in th2 LAN FEP, and the other hair of 


J 


*he gateway resident ina DIN switching nod2 whica, L 


- 


a 


conjuction with the LAN FEP, allows communication between 
tha two networks to be ichieved. Finally, a2 number of 
assumptions have been mada, which 2r2 felt will add clarifi- 
cation to concepts discuss2d, and ordvide a basis upon whic 


analysis can be conducted and proposals made. 


1) The LAN cannot affect the spe2i at which packats «ransit 


the DDN. 
2) The LAN TEP c&@nnot incr3aase the trate at which packets are 
aemt <O it Bom <he SWitshss node vast the aaximun 


transmission rate of that node. 

3) The switching node that the LAN tias into may aiso act as 
Sreithr through Which sther hosts, WOempase- OL Ene LAY, 
access the DDN. 


et detsc- 


wv 


memmeesor COnerOl, Llow control, and duplicate pac 
tion is provided for communication between the LAN FEP 
and the DDN switching node by on2 of the natwork ac 
protccols supported by the JDN. EVPete oes dation, tne 
Switching node merely views tha front end processor 3 


another host. 
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Be PACKET SIZING 


The problem of differ2nces in packet size is basically 
one of coping with the fragmentation that must inevitably 
ocsur when the two interconnested n2tworks employ different 
internal maximum packet sizes “Ref. 28: p. 4-89]. Iwo situ- 
ations may 2xist, one is when th2 naximum packet size for 
the LAN is greater than that of the Long haul network (LHN), 
the other béing when the maximum packet size for the Lony 
haul network is greater than the naximum packet size for the 
local area network. 

The first case, whan LAN maxiaun packet size is greater 
than the long haul network maximun packet size, can 0b: 
handled in one of three ways. Pabst, Lt the packet to bs 
transmitted from the LAN to LlH8N is smaller than the LHN 
maximum packst size by at least ¢th2 number of additional 
overhead bytes that will 52 adied on by the packet switching 
meas Once the packet reaches the ODN, then the packs+ 
mem. reSs NO SLZE€ modifiztation beftxre being sent *t0 the 
pwc Ching node. Seconi, 1f£ the paccat to be «“ransm 
latcger than the LHN maximun packet size, we may fragment <zhe 
Packet appropriately in th2 FE2. Each packet would be frag- 
mented such that tne new packsts wo e smaller than the 
maximum packet size for the LHN 2 


al 
2n aiter the overhead 
J Meas. A number of 


bytes were added by th2 LIN switcthia 


robi 2xi a¢ Ls qChoWiTecnhe Deluge, a Csqtirte- 
problems 2xist with this approach wh clude quire 


ment for increased software Gaeeorleeres at ‘the  fFEP, 
additional delay experienced by pack2ts wanting to leave «hs 
network, and the possibility that frassquencing of all <zhe 


packets making up the message dDéing sant may be reguired dus 
EO the insertion of a "new" pack2t into the sequential 
series cf packets tnat hav been transmitted from somewhere 
momeene LAN, And finally, if the 

Pp 


pactat to be transmitted is 
ack 


& 
= 


lacger than the LHN nmaxinun 


{v 


ee W2 ay just go 


Va 
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ahead and send the packet to the switching nois. We are 
able tc do this because the DID Staadard imeerenet Protocol, 
which will be implementti1 by the Defense -Data Network, 

provides for 2 fragmentation/reass2nbly service. It as 
envisioned that the "cver-sizei" pasket would b2 fragmented 
with each piece being sent to the destination switching node 
where the fragments would be reassembled back into ths 
"over-sized" packet. 

In addressing the s3co1d case, where LHN maximum vac 
Size is greacer than LAN maximum packet size, we assume that 
the fragmentation of a smaller LAN odacket to help fill up 32 
Pemeeosaliiy cilled larger LHN pasket will not occur. ent Aas 
Peeeuation, th Main concern o2 th® LAN ius that it might 


receive a packet from <h 


(v 


DPweeewhacsch 1s larger than it's 


eS 


maximum packet size. Ph: pe the case, tha LAN FEP must 
possess the capability to agment the larger packet into 


packets suitable for transmission on th2 local area network. 


Cw. CONGESTION CCNTROL 


Assuming probabilistic message generation and f1ix3 


er 


capacity in network compcnants, ovarlLosad would 52 inevitable 
without certain mechanisms to stop, slow down or absorb “he 
rate of message arrival. Liem oaseemsOo. Ueli= zed in the 
accomplishment of thas2 tasks i215 COngeseuon /ycontsol. 
Congestion control can ba defined as a procedure whereby 

istributed network resources, sushi 28S chann=2l bandwidth, 
Dite22= Capacity, and CPJ capacity are protectsd from over 
PtimeGrtp ion by all sourcas of network “iraffic “Ref. 29: p. 
T0900). Congestion is most likely +29 be visible at a gateway 
connecting a local area n2atwork to a long haul network. na 
sone cases, the transmission rat2s of LAN's might exceed 
m@esoe OL long haul networks by €actors of 30-100 or more> 


[Ref. 29: p. 1400]. Pvepe ape basically 2w> schools of 


eS 





mehougus when it comes to dealwag with the problem of 
Gougestion control. Thare are thos2 who advocate rigidly 
Pea comleng “he input Of packets ints a network and explic- 
itly rule out the discarding of oackets as a means of 
congestion control. And conversly, there are some who 
promote the dropping of packets as tne sole means of 


controlling congestion {R32f. 29: p. 1400]. W2 will look at 
congestion and flow control at the interface between two 
networks from both of thes? viswpoints. is the author's 
M@eent. On ¢G PrepoSe and dissuss Eachnigues of cengestion 
muir iow COntrol £oOr receipt ot packets from ths LAN and for 
reseipt of packets from tie DDN by the half of the gateway 
resident in the LAN FEP. 
iteumeean ©<O LAN Packst control 


The author has concluded that there exist numerous 
methods of congestion control, many of which have yet to be 
Myencaried,. The d2?scussidsa0 which fsllows inciudes «he pres- 
entaticn of three possibl2 methods of gateway congestion and 
mew control. These methods deal with the nandiing of 
packets received from th> LAN by the front and processor 
destined for the DDN. 

The sHmpl=st Mmethod of congestion control provides 
for the immediate transmission of packets to the DDN. ie 
mega eWay DOE TLON Of ths FEP, 12 conjunction with it's 
associated switching nole, is abla t> successfully transmit 
MeeketS tO the DDN faster thzn they arrive from ‘the LAN, 
then we can assume the requirement for congestion and flow 
Sew-erOl 25 minimal in“that direction. However, the author 
Mes  Conciuded™tha® this is rarely t12 case. Paes san oroach 
would inevitably lead to the loss of packets dues to the 
Gateways inability to transmit then at a rate comparable to 
meee OL )6CLAN. Recovery/retransmission of those ‘lost! 


packets to the gateway would pe Laft to h 


ct 


tower level 


(D 


meao7Oco!ls. 
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inecmcmmterchod tarough which congestion control az 
the FEP could be accomplished would be through the addition 
of buffers. Packets flowing in fron the LAN could be queued 
in a buffer for subsequ2it transmission to the long haul 
network. Once this puffer becomes full, pacskeats could be 
discarded as in the first method 2f a Signal >f some type 
could be sent throughout the network indicating that the DDN 
output buffer was full. Receipt of this message would also 


amply tha= no internetwork traffic should be sent until 3 


(D 


message -:S received from the gateway indicating chat th 
buffer is empty and internatwork traffic transmission can be 
resumed. 


This technique could also be empioyed with two 


buffers. Once one buffer was full, it would be disablied 
from teceiving additional packets w#noile transaission took 
place. Simultaneoulsy, the seconi buffer could be filled 


emda at's contents transmitted whea the £Eirst buffer becans 


emorye While the second ourfer's coatents were being trans- 
M2eced to the DDN, the first buffar would bé receiving 
packets from the LAN. (iicoma ee hnte ng seenalique could b= 


employed with N buffers , but ‘this would be at the axpenss 
of loosing N buffers worth of memory space in the FEP. This 
being the case, a limit to the buffer space allocated t9 
internetwork traffic wouli have t¢2) be established. With 
this limited buffer spacs, thers still exists the possi- 
Mao ty that all buffers may besonea full sinultaneously. 
This would tequire incsoning packs+s to be discarded or, 
Meeetecacion threughout the network that buffars are full 
and interne*twork packet transmission is disablei. 
iPenenealmmethbod by which ethea £loweof traffic from «he 
LAN to the LHN can be controlled is through the use of 
external storage] areas. This technaigue is vacy similar <9 
the buffering methods preztented abov2. Buffers are utilized 


Sy =he same fashion but, shen they besome full, czcather than 





Pear ngemdchers Ob NOtirtying the nstwork of the buffers 
Stace , all inco@ing oackets ar2> directed to external 
storage areas. When th2 buffers b2zjin to enpty, packets 
cucrently being stored ar2 direct2di to the output buffers on 
a FIFO basis. This procaiure reduc2s congestioa on the LAN 
by not requiring the conti1zual retraasmission of packets not 
previously accepted by th gateway. Addionally, it elimi- 
nates the need for distributed conponents to be able to 
Peeognize a “DDN buffers full message" and carry out the 
tnternetwork packet restricting actid2 necessitated by it's 


Gece: pt. 


2. iLHN 


cr 


OQ LAN Packet 


ORtroL 


2 


As previoulsy statad, we ar2 assuming that the flow 
of packets between the FED half of th gateway 2nd switching 
noije half of the gateway its controll2di by the network access 
protocols supported by the DDN. Tais being th2 case, sur 
discussion is restrict2d ¢0oO answ2rting questions such as: 
‘Should we transmit each packet imnediately onto the LAN 
upon it's receipt from ths DDN?*, oc 'Should w2 employ sone 
buffering +technigues, as>cumulatiny some packets berores 
Saansmaccing them onto tha LAN?'. 

Moees che au@aoc's  cpinisna that the trickling of 


packets onto the network one at 


ju 


tine does not efficiently 
utlLlize the capabilities of a 10 Mbit/sec LAN. This method 


reduces ne«work throughput, ani rtaguices adaptors and compo- 


ae 


neats to "wait" longer between intecaistwork packet arrivals. 
By storing the internetwork paskets in buffers or dedicated 
external storage areas, we are abl2 t3 transmit packezs onto 


momrene LAN’ in bursts. iN See Genes! ESinS) Can OCCULES arter 


po) 


+ 


ni 
an entire message is received or aft 


(b 


Ca certain number of 
packets have accumulated in th buf 


m7 


=S Or external storages 
areas. 





D. ADDRESSING AND NAMING 


Whenever any two devices must communicate with each 
other and they are not dicactly conn2acsted (1.6. a processor 
on one network communicating with 2 processor on another 
network), the question of addressiig the proper recipient 
becomes a major consideration. Adiressing across network 
boundaries requires either a staniard network numbering 
scheme ora means of address translation in the gateway 
(Ref. 28: pw. 4-49]. Ie 2S known taat the DDN will cornect 
Wath existing networks 318 well as the SPLICE local area 
networks. It is the author's dpinion that this in itself is 
Sufficient to justify tae astadlishment of a standard 
nunbering scheme. This wlll therefore be the premise upon 
which our discussion will be based. 

Many different possibl2 internetwork addressing schemes 
Sa Sts The CELT K.121 addressing strategy 1s based on the 
telephone network systen. times eesconhague allows up <0 74 
digits per address. PRO@eGes=st GedigitsS are 2 destination 
MeewOrk identifier ccd2 (I NIC), followed by the remaining 
@eaats which may be us2d to imolement a hierarchical 
aa@ressing structure [R2f. 29 p.~ 140) ]. The DARPA Internet 
has implemented a common iidress format across all networks 
it connects [{[Ref. 30: pj 1174]. Ta2 Internet address length 
Bop maexed at 32 bits. These bits contain the address of 3 
Meee culer network, ani the address 2f a host within tha 
network. Mamleneme me naisittGregatson Df thas concept might 
cali fer an address fieid shich contained a network addzess, 
*n2 address of a packet sSwitching/gateway nods within that 
network, and the address 9f 2 host ascessiblie through that 
meade. We will utilize +h addressiag technique implemented 
2n the Internet as the basis for the remainder of our 


Pesecuss.cn. 
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In order to manage, control, ani support communications 
among components distributed throughout two or more 
networks, a means must exist for axolicitly idantifying the 
couponents involved in ¢22 communication. This could be 
accomplished by utilizeingy one of tie addressing strategies 
pr2sented above. In implanenting this strategy, rather than 
requiring the user to b? aware of the strusture of th? 
network in which the jestination host resides, a naming 
convention could be established whici relieves him of indi- 
cating the actual addr2ss cf the dasired host. Ammann gs 
eonverticn can also be 2stablishsi for identifying the 
network to be accessed rather thai requiring a specific 
adiress to be provided. 

Assuming an operator nay now uss names to identify both 
piemgestimation network 22d the host within that network, 
the task of converting these to astual network addresses 
must be considered. [Translation 3f the network name to a 
specific network address wili b> accomplished by the 
mueeeeneng mode through which a SPLICE LAN is sonnected to 


tne Defense Data Network. Currently, nodes 2tcached to th: 


th 
(D 


DDN may be known by aS many 23S four different names 
feet. 3ts ps. 71771 j. Mewes dansracron O92 4° local host name 9 
its associated address ani vic? vers:, could be accomplished 
by the switching node. Lic Ste moGeOocsS mOt SUDPDOrt this 
approach for the major r2ason that the Switching node will 
most probably be connecting other n2ztworks and/or hosts to 
fmme DDN. Sommer CO DOss2bly perforin these translations 
WwOdild mean a reduction in the nod2's capability to perforna 


MemoLoMery tuncti.ons of traflic processing, host access, 


| 


Guting, 2NdemenetOLang and COntroal [Ref. 31: op. S34. 
Therefore, local host name translation mus* be performed 2+ 
the lecal level. 
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This local translation capability could be accomplished 
at the interface between a distributed component and the 
bus. This weuld require the use 9f additional component 
resources for the performance of a function which could most 
efficiently be implement2]i at a cantralized location (1.3. 
the Front End Processor), rather than at eacth individual 
component. Dp cCeePoaicemg uno Focal tramelstion “Capa 
bemeacty into the LAN'’s FEP, we not only reduce redundancy 
throughout the system, but also fasilitate the maintenance 
of our translation tables. The final issue to be addressed 
is concerned with the plasc2 (sources o© destination network), 
Pemebeen cCh2S translation gccurs. fFranslation of the desti- 
Mations hame c2n either ossur at thz source's gateway or at 
the destination network. By delaying translation of thse 
nane to an address until arrival at the destination, wa 
eliminate the requireneit for each gateway to possess 
specific address aie Ol Matlon about other networks. 
Sinilarly, the *ranslation of a procsess name to a process 
adizress would also be accomplish2i by ths destination 
networks FEP. The half yateway casident in each SPLICE FEP 
wouid only be required tS maintain 2 table containing ths 
Bames end addresses of it's lical souponents and processes. 
Upon receiving a packet from tha %IDN, the component and 
process string names would be conparsd against entries in 
the address translation tables. Appropriate addresses would 
replace the physical noie name and process name. The packet 


wo1ld then be ready for transmission onto the local bus. 


Ee ACCESS CONTROL 


Access control is concerned with establishing mechanisms 
that may be required to prevent some traffic from enterin 
SmaepOssibDly some traffic from leaving the network. This 


filtering action is ideally accomplishsd by the gateway <«wo 
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networks. Utilizing our nodel of a "two half-gateway", each 
half can deal with controlling access to the network that it 
Sse Comnecte duto.n What this means is that our haif of ths 
gateway in the LAN FEP san act 3235 2 sentry tO incoming 
eeatfic. As traffic arrives, the "ID" of the packet(s) can 
be checked against a tabl2= containiiy the "names" of thoss 
packets which are authoriz2d to enter the LAN. If a packets 
"TD" appears on the access list, antry is granted, if not, 
the sentry may either discard these sackets or possibly send 
wae tO an access contsollearefaef. 29: pe. 1401). The access 
controller routine can ta2n dynamicaliy enable the flow of 
the packets into the network after pecforming cartain checks 
on the packets identity, or, it may decide that these 
packets are not to be alloweil ints the network, discard 
them, and send a suitable ‘canned cizsponse to the source of 
tha packet(s) latting lt know ascesss was adt aranted. 
Alternately, it may inforcn network »perations personnel of 
the packets that wish £5 enter the network and request 


action to be taken. 


F. OTHER CONSID ERATIONS 


Two additional areas of constera associated with thse 
interconnection of two networks are Failure notification and 
Besoun<=ing procedures. Assuming that failures for ths 
connected networks are detected, Pet clawed, and asolated 
internally by 2ach network, the question arises 'How is thea 
existance of a failed conponent within a network communi- 
cated *o thos? in other raatworks wad may wish to use thas 
conpenent?!'., AssumMing tnat both th> LAN configuration data 


base and probicm managemsit data bas have both been updated 


ct 
tD 


With the current status 9f any particular failure, oh 
h 


Gt 
(D 


researcher maxes the following propssals in response to 


previous question. Befoc> packets are let ints the local 
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Greamemetwork, tre haii-jateway will be responsible for 
checking these data bases to insure that the desired desti- 
nation is operational. IF it is, and assuming the access 
controller has permitted ascess, th2 packets ar2 transmitted 
into the network. If the desired lsstination is currently 
inoperative, a respons2? iadicating sich is returned to the 
source. Additiomally, if a sourt2e from another network 
desires to check the statas of an alement within a SPLICE 
LAN, it should have the sapability, just as a local user 
Would, of querying either one of these data bases. Also, it 
memeccumea that if the switching nods through hich a SPLICE 
LAN is ccnnected to the JDN fails, then the responsibility 
Memceporting the inaccessibility 3£ that particular local 
ipsa) MetwOrk lies with the DDN Monitoring Center who's 


jucistiction includes th failed node. Saal 4. Aeeyg the 
failure of a.-LAN FEP which makes a SPLICE LAN configuration 
inaccessible will be reported to opdteantial network users by 


mie cOmmecting Switching aode 
ieee sS the fecearcher’s opinion that a SPLICE LAN is seen 
aS just another subscriber to the JDN. This being the case, 
there seems +9 be sufficiant justification for the estab- 
lishmenz of some type of 2azcounting orocedures which provids 
bas means through which che flow of packets to and from ths 
DDN can be monitored. Assuming some type of atrounting will 
be conducted by tha sSwitcaing node, the connected LAN could 
meagan iaccounting infornaticn fron it. this Moss? not 
DG Omet ec wesswlt Ching 
eNcs i oes 


provide for any type 2f cross checki 
2 js 

lishes the requirement for SJm2 sort of. “acc 
+ 


Mea="S accounting capability or accuc 


procedures to be established in tae LAN's hal 

gateway. CUrecmely, OWUSlLLC packet switching networks ars 

uSirg procedures which aztrount for subscriber use 

bDesis of the number of victual circaits established during 
en 


the accounting period and the number of packets 5s 


81 





Pema Circuit [Ref. 29: p. 1800]. Only slight modifica- 
tions to certain reports ceconmeniei in Chapter 3 would be 
required to give a SPLIZE local area network a similar 
Meaolntiang Capability, —m Finally, ani most important of all, 
-s that the accounting nezthanisms implemented by the SPLICE 
LAN's be based upon procsiures and units of asasure iden- 
pucal, @© very Similar to those utilized by the DDN. 


G. CHAPTER SUMMARY 


Wwe began this Chapt2cr with a discussion of various 
configurations that 2 gateway beatw2en computer networks 
could assume. The autaoc feels that the "two half-gateway" 
concept offers the sSimpl3st and 1dst effective means of 
interconnection. The discission thea turned to the problems 
associated wit differant maximum packet sizes utilized by 
tha two interconnected astworks. 42 looxed x7: the situ- 
ations when the LAN maximin packet siz2 was greater thar the 
Jong haul network maximun packet siz2 and vice versa. ie) 

tO 


both cases, Suggestions ‘were mada 325 27 


}--? 


Mow Sthis preo 
couia be handled. Wer a weGCieSwon, Ge Siow control and 


cceagestion control techniyies was ti2n entered into. Phi 


Ui 


problem was approached from two dirastions. First, control- 
Mmerg the flow of packsts intdS ths LAN half-gateway for 
transmission to «he DDN. MeGesceond, “colmtrolling the flow 
OI packets from the Defense Data Network, ehEeough th= 


gateway, ono che iLaN. The prdolens of inte 


r 


natwork 
adiressing and component namin wec2 then considered. Ths 
Senor haS cOnciuded that the solution to the first probien 
would be the éStablishmant of a standard internetwork 
nunbering and addressing szheme. [The standard offe 

Semene cOzrm, NETWORK ADDRISS/LICAL HIST ADDRESS. Th 
Rent naming problem was founi t9 be best handled 

a 


levels. Iitweiaansitatioy Of 32 network name to 
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metwork address would be conducted at the switching node 
half-gateway, while the translation of a local host name ¢t9 
a local host address would be acconslished by the destina- 
tion network hali-gateway. We then briefly ijiiscussed the 
mOopa1c OL access control.. There, we looked at the role 
played by an access controller, and attempted t9 add support 
foc it's implementation in the SPLICE network. Pinally, we 
looked at the need for failure notification and accounting 
capabilities associated with internatwork traffic. 

Exciusivs of the interface between a SPLITE LAN and «h;3 
Poy, «he monitoria and Qanayem2nt of a SPLIZTE local area 
Meework =S predeminantly centraliz:2d. SHECial «in eersace 
functions such as those ilascribed in this Chapter requi 
ieee CON<tOl OF thass functions be distributed to t 
FEP. rinelly, Pio see lo scatci1ss 'S Opanion char © 
management of the LAN/DDN interface must not only be wor 
able, but must be accept3291le from 231 operational standpoint 
Beeeene Users, and Erom 4 2=2chricael a2qd logical standpoint by 


network operators. 
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VI. LAN CENTRAL MONITORING SITE 

The integration of those manajgenent tools discussed in 
Chapters 1-5 is accomplished by the local area network 
Central monitoring site (2MS). It is here where measure- 


ments and statistics are collected, performance analysi 


ti 


t- 


conducted, diagnostic programs ani recovery actions in 


4 


iD 
i} 
(Dp 


( 


he 


- 
2 =e 


ated, network utility data bases uvodated, and wh 
1m 


ber rtormance a adjustment n2essages originate. 


ur 


rocess of managing from a central location minimizes commu- 


ie 


Beeaeiens and synchronization  sditics, and helps solv: 


problems that may otherwis2 pass unnoticed [Ref. 33: p. 21]. 

The author will inittally preseit what he feels to ba 
tha mission of a central nonitoring site, followed by appro- 
priately supportive objectives. [The manning requirements 
MUpEE@SGshI1Zationdal strustuce associated with a MS will «hen 
dpe discussed. PO Me Ns 22, 2 ALSCUSS On Of 2 CWOEK 2Dera- 
Gamers WOrK Dench will be aaterel ints. Finally, 2 discussion 
Bea 2ecNOrk Sperator's resnogsibllities under both normal 
meaecteiiure conditions will be pressaated. 


A. MISSION OF A LAN MOTITORING SITE 


The mission of a LAN central noaitoring site might bse 
peeeagec= , ‘ro insure tie most sfEfisient and sffective use 
a 


St 
Or network resources and to maxini 
+h 


Z 
iroughput and responsiveness’. Ibjecctives which support 
the accomplishment of this mission 3 


BepeeeDangd track 9& the status ani configuration of th 


(bp 


Network. 
- Detecting alarm conditions and failed components. 
g C 


Pee SaYorg oUt fault isolation end iia 
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[Mines ctind TaepbOpE-1A<> tepairc personnel and monitoring 
repair activities. 

= Altering the thysical and logisal network configurations 
and documenting such alterations. 

= ae >S component performance parameters. 

- Generating management rcr2ports. 

= Supperting test and acceptance activities. 

- Provide information needed for planning future network 
SOLU LON. 

Per OViGe a historical data base 4ajg2inst which current ana 


future networxK perform2ace may bs neasured. 


= 


[one or component Wtilization throughout the natwor 
(e.g. host, communication processor, and shared resources 
eee aide OT) 


u 
SeeeertOrm a SChedGiing Eanction f2r application progr 


fv 
Ul 


i 


= 


POereng Use Dt the host processors. 


tater cite seeeeg1. ObjecCloiv2s ars Sinilar to those containd 
Mame ae FPrIdzram 2Yian for the Detens> Data Network. [Ret. 31: 
Pe 142). vem era Oth Ltems are cbjeccives of 7:2 
Meme tce j2VermOm= Laboratety I22390us Network Monitoring 


n &D > 
pmeeicesuriag Projec= fRef. 34: p. 2]. The final two objec- 
v Dp u 1 


An analysis Cee imo jocraves snows <ha2 the tools 
discussed in this paper ar2 capable 2f accomplishing che Ist 
m@eeuch the 7th and the i1lth oojectives directiy. A ie POU sa 


mot menxloned 3S yet, th2 central nonitoring sita must be 


mere cO Support the testiag, evalustion and acceptanca of 
MemeecOmpOnents that ar2 to becom? oart of the local are2 
network. By «establishing the iata bases described in 
Seer e> |i, we 3relndirectly supportiay che accomplishment of 
mi—meeen and 10th objectives. The estabiishmant of data 
bas¢s which reccerd network perfornaicts measures and compo- 
M@emece Wel lization statistics would greatly enhance our 





ability to meet these objectives. At theis®) tame, the 
researcner does not sez a need for the design of a sched- 
uling algorithm as proposed by the final objective. As 
applications grow, and th2 number of network users increase, 
+he requirement for establishing a scheduling algorithm for 
the purpose of efficiently and fairly assigning jobs to host 
processors, may become very real. An @2xample oof where a 
scheduling algorithm has been implemented is on the Los 
Alamos Scientific Laboratory Integrated Computer Network 
eget. 35). 


B. MANNING AND ORGANIZATION OF A LAN CMS 


How many people are reaguired +29 insure the continued and 
a 


efficient operation of a SPLICE local ea compater network? 
Seed +he monitcring sits be manned sround the clock? What 
Camewe=t the “add2ce 

2 


the guéestions that 


organizational aspects aust be conside 
Sema central monitoring site? Th2s2 ar 
Wee De addressed in this section. During the discussion 9f 
each, a possible answer will ba reconmended by the author. 
The manning proposed for the DON monitoring centers 
Tange from four people at the syst2m gaonitoring center, fron 
Mme cr Ze5O at other centers (Ref. 31:3: p. 137]. The manning 
of the NBSNET (a bus oriented Local computer network) meas- 
urement center calis for 4 full-time and several part-time 
Omputer-electrical enginaars “Ref. 36: p.j 13]. Naither of 
thsse manning levels seams appropriate for a SPLICE LAN, the 
DDN being a much larder iong aaui network, and the NBSNET 


Maoning level reflecting aore of aa exoerinental environ- 


ment. A local area network with a structure vary similar = 
Mire Ot a SPLICE LAN is the Hughes Aiztcraf= Company Janet 
network [Ref. 37]. Wars Ras Ssperpaiized the control ana 
Meme-OLrIng Of the network ata single operator position. 


From this position the operator can issue commands to all 
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network components, perform testing and performance anal- 
ysis, detect and diagnos? failures, and reconfigure the 
network. The degree 9f autonation recommended throughout 


this paper would provide the capabilities required for a 


fone person! central monitoring sits. If these and other 
lower level functions ar2 not autonated, the possibility 
exists that an additional operator may be required. The 


author feels that substantial processing will occur, and 
that file transfers between Stork Points and Inventory 
GConerol Points will take solace after normal working hours. 
meemehis treason, 1t 1S fslt “that a network operator should 
be available at anytim2 orocessinj is in progress. NEDer 
hormal working hours, this position may be filled as 3 
collateral duty (i.e. tha individu2l filling this role may 
also be responsible for on2 of the host processors). 

In answering the question as t2 where tha monitoring 
Site fits into the organizational picture, one nust remember 
ea. the CMS can exercis= a gra2t i2al of control over ths 
network and it's componéeits. This being the case, those 
femeradualS COMprezsing th2 CMS must work directly for the 
MUieceeOr Of the LAN'. a2 would not want the central mnoni- 
meen Site tO come unier the contrsl of one of it's users 
Oe under the control of on of “the staffs associated with a 
network host. This s2ans td add more justification for 
Serb lashning the position of "Director of the LAN®. This 
Pemeec tor could operate out of the central monitoring site. 
From here, he couid manaye and control the operations and 
Mememrces Of the focal nst¢work, focmulate network policy, 


and see to it's implementation. 
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C. A NETWORK OPERATOR'S W) RKBENCH 


A network operator's workbench is a single, integrated 
system containing all th2 operator's tools in one place. 
Th2 system must be interactive and, because new analysis 
packages and models wili b2 continudusly developed, possess 
the characteristics of a programmer's workbench "Ref. 21: p. 

4}. 

| Certain hardware ass2ts will a2nable the operator <t9) 
better carry out the network management function. The 
Meomainei or terminalis utilized by the CMS should have 4 
fairly extensive graphics capability. For example, 4 
display cf the entire natwork could be put on the screen 
Meee O2tterent colors tLadicatiag the status of various 
conponents. A dedicated printer will be needei for manage- 
Boal rSspoLrts, but mora importantiy, for the recording of 
failure messages receivei by tha <cMS. Adequate direct 
access steorage will als> b2 a necessity. Additionally, an 
alarm capability for indisating the breaching of established 
parameter tnresnhoids will be required. 

There exists numerous softwar:2 wOOu= that can b= 
Peeeierzed by che network ooaratar. Ine sf the most important 
2s a good DBMS with 2 complete, user friendly query 
Language. This asset wili allow the sperator tt) investigates 
relationships between performance m2asurements and asscci- 
acted parameters, and to ask exploratory questions concerning 
fms CLLect Of certain network confijguraticns on performance 


Ses ceria. The possessida of a wori processing capability 


+o 


UW) 


- 
—_ 


Will aise assist the oparator in the perfornance of 
t 


@utles. An additional ssftwere is the actual process 


~ 
pen ms 


50) 
Wi 


mmmeugh which =he operator interacts with these tools. Thi 


UW) 


S 

anterface may be through a Network Operating System as 
cucrently planned for tha DDN [Ref. 11} and described ia 
meacct. 32). AwoeeworncphEoacn £€O =£A2S HProbléem is to have che 
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operator interact with the softwar2 tools through an appli- 
cation program. The Hugh2s Aircraft Company has implemented 
a Network Monitor Program for it's JANET network which runs 
as an application program on one 9F the host processors 
(Ref. 37: yp. 96 j. The distributed counterpart of this 
central control program is a ‘background! program included 
as part cf the adaptor microcode. It is through these back- 
ground programs that the OMS receives certain measurements 
and failure messages. Mitt etonad, SOrtewers tools that wiil 
be of heip to the operator include: an English language set 
of commands for ease of system operation and n2twork diag- 
moestics, default paraneter value establishment ie 
unspecified by the operator, dynamics control programs for 
adjusting lower level performance paramentéers in accordance 
with network conditions, and finally a system which exists 
for prompt and accurate collection of any datz the user may 


provide on a problem. 


D. OPERATORS ACTIONS: NORM AL CONDITIONS 


Py “ne 


ah 


In the next two sections w2 will attempt *9 identi 
responsibilities of a natwork dperator under both normai 3nd 
abnormal conditions. They are pres2nted here in an affore 
memeoGablish a basic set of responsibilities for all SPLICE 
LAN operators. This sacstion deals with the operator's 
Bespons?bDilities under nogaal sconditions. It is resaiized by 


the author that some of these r2sponsibilitiss may also 


Ber-ain to failure conditions. Pye ee aS | «6oNOS Known 
Memeo, Lt amy, Of the iientifiei responsibilities will be 
automated. therefore, the discussion of responsibilities 


Will be presented as if the operator had to. take some 
ese’ tic action for it's ascomolishment. 
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1. inter alazetzon 


Assuming the network operator has just invoked the 
network management control program, there are certain func- 
tions that must be aszomplished. The operator must 


establish a connection with the ‘baskground' program in thé 


adaptor or component interface. MNOngG-Cener thands, this 
will enable him to find »ut just who is on-line. Once 
connections are established, tha operator can send out 


instructions to the nodes providing them with guidance as +9 
what measurements to take, when to send them to the CMS, and 
upcoming maintenance acitvities. Also during this time, thea 
network cperator obtains the physical and logical configura- 
meme tables for each host and communication processor, which 
is then stored inthe a global network configuration table. 
Ducsang initialization the network operator also sets 
performance parameter values, establishes alarn threshhelds 
for performance measurements, identifies critical components 
which he is specifically interea 


rad 2 monitoring and 
E 


Ss n 
updates the Name/Address Table in ths FEP halt-gateway. 


2. Utility Data Bases 


Pieemmc: 1ON ODt ai edwstron 2sach component about 
itself and it's associated peripherals is used to update che 
network configuration data bas2. This provides the operator 
with a view of the physit:3 state Ofc i=. NStWwOnKs 
Magacionally, ilegical configuration tables can be estab- 
lished for each component and user, which giv2s them their 
Sage CUS<~OMmized* configuration of the network. pels Cee ie ng 
ais time, probiem management, change management and 
performance analysis data bases may be opened for read/write 
and checked for items of interest. Peeve Che operator 
nesds =O communicate with the DDN Wonitoring Cénter who's 


mesa Of ianfiuence the LAN fails within. Thiers witeract 1on 
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may Simpiy be the transfer of the current DDN status file to 
sie) (CMS. This file can then be used to assist users 


attempting intsrnetwork coamunication. 
3. Operator's Displays 


The network operator is responsible for monitoring 
various network status displays and in some cases insuring 
their availability to users. Thas2 status jisplays ars 
created from data obtain2i from coifiguration and problem 
Management data bases in addition +t) results of performance 
analysis and component monitoring. AS @ Minimun, the status 
Gisplays that should exist include: a global natwork status 
Gisplay, displays fer 2ac1i major conponent with appropriate 
Operating information, iJlisplays f2r any desired network 
performance parameters such as throughput and response time, 
a general information display For informing usecs of sched- 
ul2d maintenance, DDN's status and administrative 
Gepevecies, andeaedisplay fom depicting load infcrmation on 


hosts and ccmmunication processors. 


4. Normal Management Activiti3s 


em 26 22 Ge = =p a= ae ae Sp se 2 ee 


(D 


Mime tetetonntO Ehase estivitiss nention]ed above, +h 
network operator is als responsibl2 for the accomplishment 
of other normal management artivities. He nust initiate 
monitoring periods for the collection of measurement data. 
Upon the completion of the monitoring period he must: 
MeG@iem@l =ne tzansiter of tata irom ths adaptors +o the CMS, 


disable adaptors from taking additional measurements, and 


jw 


clear adaptor memory contsnots if so required. 

tilizing data gathered, a14 statistics generated 
ducing the monitoring period, the network »xperator. must 
insure the appropriate data bases are updated. This may 
include modifications to the confijyuration, problem mnanage- 


ment, and performance analysis d1at2 bases. L2eoOrNa= -On 


91 





obtained during. the monitoring perioi is also to. be used by 
the network operator +t5 ijentify trends, look for bottle- 
necks in the network (espertially at the DDN/LAN interfacs), 
conduct network performanse analysis, and prepare network 
status and utilization reports. A#hile analyzing results of 
th2 monitoring period, th2 operator nay become aware of some 
pending component failures. If so, appropriate action is 
taken to diagnose and correct the failure. More specific 
action to be taken upon failure dstection will be discussed 
in the next section. 

Other normal manajy3ment activities include the oper- 
ators responsibility to test 211 adaptors failure detection 


ani diagnostic capabilities, the distribution of new soft- 


ware versions, adjustment of network logical and physical 
configurations, and adjasting performance parameters in 
orjier to tune the network. The network operator is also 


responsible for inforniajy and coordinating with users 
planned maintenance activities. Qn2 final responsibility 
calls for CMS personnel +> be involved in the installation, 
testing, and acceptance of equipment that is going ~9 become 
part of the network. 


Ee. OPERATORS ACTIONS: COMPONENT FAILURE 


Having utilized the oerformanc2= analysis, and problem 
tection and diagnosis tachniques presented earlier in this 
aper, iet us assume the network s2¢erator has identified a 
failed component. What than are th2 orocedures that must be 
BomeOwed in Order to manay> this failare until it's rectifi- 
@aeeOn? ASSUMing the failare is of aajor significances, such 
as @ down communication processor , one of the first <hings 
the operator should dois notify th network of the failed 
component. COMenGaently, COnEIigUuracion tables, «he problem 


Managemert data base, ani the Name/Address Tables in the FEP 


gi 











should be updated. Appropriate entries for the problem 
Management and configuration data bases are shown in 
Appendix A and Appendix B respectfully. Hayeng Gone this, 
the operator may utilize some form 9f DDT as discussed in 
Chapter 4, in an attempt to sorrect or further isolate the 
cause of failure. fois seeks, Ene OpeTaese Can utilize 
the information that h2s been recorded in the network 
history file to try and ‘backup! th2 processor to a point 
berore the failure occured and att2amot a restart. The last 
Chance the operator has to correct the problen is to dump 
the suspected failure causing software to off-line storage, 
ani relcad the system with a fresh topy of +h? appropriates 
software. Having exhaust2i his means of problem correction, 
tha operator is responsible for contacting the? appropriate 
vendor. 

During the course of problem idantification and correc- 
tion, it is required that thé network remain available for 
customer uss. i waOucth ls, the natwork operator must have 
j= Capability or reconfiguring 222 “RECNOEK, disable 
processing of local cperator requests so “that he is in full 
centrol of the network, activate ani isactivats 2 components 
connection to the bus, ani transfer functions performed by 


the failed component to another devises capable of performing 


See function. Although ths performance of the netywork 
during this time will not be sptinun, it will at least be 
able to suppor = some proc2ssing reguirements. Upon failur: 


Correction, the operator is responsible for bringing the 
System back t2 a state 9f adrmal speration. ha = went 
inciude updating the appropriate 12t3a bases, BotuEDi ng Of 
functionel respensiblities as requirc2d, and norcifying users 


of the resumption of normal services. 
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Fo. CHAPTER SUMMARY 


In this Chapter, we bagan by presenting the mission of 3a 
network central monitoring sit2 ani th2 objectives to be met 
mo opder to fultili that mission. A discussion of the 
Manning and structural aspects of 2 CMS was then entered 
eit O. Attention was thea focused »n the description of 3 
network operators workbench and its' associated tools. Our 

inal discussion dealt with th2 ideatification of a network 
operator's responsibilitirs under both normal and failur? 
Sanaa tions. 

It is the author's opinion that the mission and objec- 
tives presented at the beginning sf this Chapter provide 3a 
complete and succinct picture of e2xactly why a network 
ceatrai monitoring sit? 2xists aad what services it must 
provide for the network. [The researcher recommends that the 
monitoring of the network be automated +o a point such that 
Smemey One Operatcr and his sStarf ar2 required to 'control' 
mieeneswOrk. It is als> Felt that the position of "Director 
or the LAN' be establishei as part of the CMS with authority 
Over ail aspects of network utilization. The toois recon- 
mended aS part oof the operator's workbench are seen as ths 
basis upon which netwerk nonitoring, control, and management 
will be conducted. Without them, ti accomplishment of «+he 
central monitoring site's nission will be questionable. iS 
conclude, it is the rassarchear's opinion that the network 
Op2rator's responsibilities we hava identified in this 
Chapter, altnough not ali encompassing, can b2 used as 3 
basis upon which extended and nore sosecific reguirements can 


per pui.t. 
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PROBLEM MANASEMENI RECORD ENTRIES 


Time and date of problem awarensss 

Type of equipment and serial number 

Remarks about the natur2 of the problea 

Lojicai name of the affected natwork element 

Target date and time for problem resolution 

Current problem status 

Assesment of problems impast on network components 

Cross reference to appropriate Seay es in CONE IGirarion 
management database 

Physical location of oproblen occucance and of eélements 
reporting «he preblen 

Dat and tine of problem r2solution 

Point or contact and phon? number tarough which additional 


information concerning th2 problem can be obtained 





CONFIGURATION MANAGEMENT RECORD ENTRIES 
Item of Equipment 

Medel and serial numbers 

Physical address 

Conponents logical name 

Reatal/Purchase price 

Depreciation information 

Instalied/uninstalied status 

Order number 

Ship date 

Lease start and end lease lates 

Vendor name, phone number, and addr2ss 

Associated node iogicai nane 

mem Gescription /Etunction 

Renarks 

Mmewn- Of COfitect;: name, idcation, telephone number 
bu 


Machine software was execiting on #han problem was d 


t 


lding and room piece of equipment is in 


iD 
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